In-memory shellcode staging via VirtualAlloc + BCryptGenRandom sequence

Emiliano Mema@Nosalva

•updated Jul 9, 2026•0•0•2

This rule detects processes that perform both memory allocation (VirtualAlloc) and cryptographic random number generation (BCryptGenRandom) within a short timeframe. This combination is highly characteristic of reflective loading or stage-based process injection, where an adversary allocates memory for shellcode and generates keys or seeds for encrypted payloads, often used to evade signature-based detection.