Grixba RWX Memory Creation and API Resolution from Unbacked Memory
Detects the GT_NET or Gt_net executable calling the VirtualProtectEx API to modify memory permissions to PAGE_EXECUTE_READWRITE. This behavior is a common indicator of process injection, where an attacker modifies memory to execute shellcode or malicious payloads within the context of a legitimate process.
CQL
