VSHELL UNC5221 RWX APC Process Injection into Windows Host Processes

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

This rule detects a sequence of Windows API calls indicative of process injection behavior associated with the VSHELL RAT (UNC5221). The detection monitors for the combination of VirtualAllocEx (with page permissions allowing execution), WriteProcessMemory, and QueueUserAPC or NtQueueApcThread targeting common Windows system processes (svchost.exe, explorer.exe, notepad.exe) from the same source process within a one-minute window.