ListPlanting Injection via SendMessage API Payload

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects a 'ListPlanting Injection' attack via the SendMessage API payload within HTTP traffic. It specifically looks for the strings 'LVM_SORTITEMS' and 'SendMessage' (case-insensitive) in the file data of an HTTP response flowing to the client. This type of injection is often associated with shellcode or code injection techniques.