OXLOADER Self-Modifying Decryption Stub: VirtualAlloc + mpr.dll WNetAddConnection2W

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

This rule detects suspicious process injection activity characterized by a sequence of API calls (VirtualAlloc, CreateRemoteThread, WriteProcessMemory) in conjunction with the loading of 'mpr.dll'. This combination of events can indicate an attempt to inject malicious code into a process, potentially for evasion or privilege escalation. The rule filters out common legitimate processes to reduce false positives.