Multiple STATUS_INVALID_PAGE_PROTECTION Errors

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•5

This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.