Drun Chromelevator Direct Syscall Process Injection (NtAllocateVirtualMemory/NtCreateThreadEx)

Ethan Andrews@eandrews

•updated Jun 22, 2026•1•0•6

Detects the Drun/Chromelevator loader (drun.exe) performing cross-process memory allocation and remote thread creation via direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR user-mode API hooking during reflective payload injection. The rule specifically looks for 'drun.exe' initiating these syscalls.