TLS Callback Injection Payload Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the presence of a TLS Callback Injection payload in HTTP traffic flowing from the server to the client. It specifically looks for the case-insensitive strings "TlsCallback" and "IMAGE_TLS_DIRECTORY" within the file data of the HTTP response. This technique is often used by malware to achieve code injection and execution.