Nimbus Manticore - RWX Memory Allocation API Call (T1055)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•5

Correlates processes executing from the Public directory utilizing VirtualAllocEx to allocate PAGE_EXECUTE_READWRITE memory, a precursor to process hollowing.