Chromelevator/Drun Reflective Injection via Direct Syscalls
Detects the Chromelevator loader (drun.exe) performing reflective injection of an encrypted payload DLL into a remote process using direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR hooks. Also detects the spawned vt-windows-event-stream.exe helper process.
Microsoft Sentinel (KQL)
