Win32k KernelCallbackTable Injection via VirtualAllocEx RWX and WriteProcessMemory into GUI Process
Detects cross-process memory injection patterns by correlating Event Tracing for Windows (ETW) logs for VirtualAllocEx (with executable protection) and WriteProcessMemory, combined with Sysmon image load events to verify the target process has loaded user32.dll, a common indicator for GUI-related processes often targeted for injection.
Splunk (SPL)
