PowerShell Memory Manipulation API Calls

Ethan Andrews@eandrews

•updated Jun 9, 2026•9•0•13

Detects PowerShell commands that include references to memory manipulation APIs such as Reflection.Assembly, VirtualAlloc, WriteProcessMemory, and CreateThread. These APIs are often associated with advanced techniques like reflective PE injection or shellcode execution, indicating potential malicious activity.