SNOWLIGHT RWX APC Shellcode Injection via VirtualProtect and QueueUserAPC
This rule detects potential process injection attempts targeting the Windows Update Service (wusvc.exe). It monitors for suspicious API calls, including VirtualAlloc, VirtualProtect, WriteProcessMemory, and QueueUserAPC, or memory page protections set to PAGE_EXECUTE_READWRITE within the context of the wusvc.exe process. The detection requires multiple distinct indicators of injection to be present, reducing the likelihood of flagging benign administrative activities.
Splunk (SPL)
