APC Process Injection from User-Writable Path via Sysmon Event 10 and 8

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects potential Asynchronous Procedure Call (APC) injection by monitoring for processes running from user-writable directories that request broad access (PROCESS_ALL_ACCESS) to other processes, or by detecting the initiation of QueueUserAPC or NtQueueApcThread remote thread creation.