Suspicious Process Memory Allocation
This rule detects processes that repeatedly attempt to allocate memory, which can be indicative of malicious activity such as injection, evasion, or resource exhaustion attacks. It specifically looks for Event ID 4688 (process creation) where the command line contains keywords related to memory allocation (allocate, reserve, memory, malloc) and excludes common legitimate processes like SQL Server, Java, and Python. A count of 3 or more such events within an hour for the same computer, filename, and user triggers the alert.
Microsoft Sentinel (KQL)
