Grixba RWX Memory Creation and DLL Load from Unbacked Memory Caller
This rule detects potentially malicious activity associated with process injection, specifically identifying memory regions allocated as Read-Write-Execute (RWX) or the loading of sensitive DLLs (amsi.dll, wldp.dll) from unbacked memory regions, which is a common indicator of process injection or shellcode execution.
Splunk (SPL)
