description: Detects PowerShell using VirtualAlloc, CreateThread, and similar API calls for memory injection techniques. - 'VirtualAlloc' # Detects use of VirtualAlloc, a Windows API function used to ...
and where the call stack is pointing to an IIS Web application as the source of the injection. _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection ...
VOID#GEIST malware campaign delivers XWorm, AsyncRAT, and Xeno RAT using batch scripts, Python loaders, and explorer.exe ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results