Drun Chromelevator Direct Syscall Process Injection (NtAllocateVirtualMemory/NtCreateThreadEx)

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•4

Detects the Drun/Chromelevator loader (drun.exe) performing cross-process memory allocation and remote thread creation via direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR user-mode API hooking during reflective payload injection. The rule specifically looks for 'drun.exe' initiating these syscalls within a 5-minute window.