Reflective PE Load via VirtualAlloc RWX + WriteProcessMemory to Self

Duo Tech@duotech

•updated Jun 22, 2026•0•0•4

This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.