In-memory shellcode execution in powershell.exe via VirtualAlloc/CreateThread with dynamic API resolution
Detects a suspicious sequence of PowerShell activity involving memory allocation (VirtualAlloc), thread creation (CreateThread), and dynamic API resolution (GetProcAddress or LoadLibrary) within a short time window. This pattern is often indicative of reflective code loading or in-memory process injection, which are techniques used by adversaries to execute malicious code without touching the disk.
Microsoft Sentinel (KQL)
