Codex - RWX Memory Allocation for Injection (T1055)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Correlates the PowerShell process allocating virtual memory with PAGE_EXECUTE_READWRITE permissions, setting up the memory space for process hollowing.