Reflective In-Memory Shellcode Execution via CreateThread into Unbacked Memory
Detects the creation of a remote thread that initiates execution from memory that is not backed by a known file module on disk. This is a common indicator of process injection techniques, such as reflective DLL injection or shellcode execution, where the payload exists only in memory.
Cortex XDR
