Application Runtime Memory Manipulated via Web Shell

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to manipulate application runtime memory via web shell activity. Specifically, it looks for HTTP requests where the URI content contains the string "WriteProcessMemory" (case-insensitive). This string is indicative of an attempt to use a function commonly associated with injecting code or modifying the memory of a running process, often a technique employed by web shells to achieve persistence or execute arbitrary code.