SNOWLIGHT RWX Memory Allocation and APC Injection for VSHELL Delivery
Detects potential process injection attempts involving the Windows Update service (wusvc.exe). The rule monitors for remote thread creation or APC injection activities combined with memory operations (VirtualAlloc or VirtualProtect) that set memory regions to PAGE_EXECUTE_READWRITE, which is a common pattern for running shellcode in a hijacked process context.
Microsoft Sentinel (KQL)
