SNOWLIGHT APC Injection Chain: VirtualAllocEx+WriteProcessMemory+QueueUserAPC from wusvc/rundll32/regsvr32

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

This rule detects potential process injection by monitoring a sequence of API calls (VirtualAllocEx, WriteProcessMemory, and QueueUserAPC/NtQueueApcThread) originating from common system processes like wusvc.exe, rundll32.exe, or regsvr32.exe. The sequence indicates that memory with RWX permissions is being allocated in a target process, written to, and then triggered for execution via an APC, which is a common pattern for malicious code injection.