Cross-Campaign - VirtualAllocEx with PAGE_EXECUTE_READWRITE by Scripting Engines

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•4

Detects memory allocation anomalies where VirtualAllocEx is used with PAGE_EXECUTE_READWRITE protection by common scripting engines such as Python, Node.js, WScript, CScript, PowerShell, and AutoHotkey. This behavior can be indicative of process injection or other malicious memory manipulation techniques.