Starland RAT APC-Based Process Injection via QueueUserAPC

Duo Tech@duotech

•updated Jul 16, 2026•3•0•3

Detects process injection attempts leveraging Asynchronous Procedure Calls (APC) by monitoring process access events for a characteristic API call sequence involving VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and CreateRemoteThread, commonly associated with the Starland RAT.