Potential Shellcode Injection via Process Access
Detects potential shellcode injection attempts by monitoring process access events where a process requests specific access rights (0x147a or 0x1f3fff) and the call trace contains 'UNKNOWN'. This behavior is characteristic of tools like Metasploit's migrate and Empire's psinject, which inject shellcode into other processes. The rule includes filters to reduce false positives from legitimate system processes like Wmiprvse.exe accessing Lsass.exe, Dell software interactions, and Microsoft Visual Studio processes.
Sigma
