GRrte.exe RWX Memory Loading and ws2_32.dll Proxying (PlugX)

Kaung Khant Ko@kaungkhantko

•updated Sep 19, 2026•0•0•5

This rule detects potentially malicious in-memory activity within the 'GRrte.exe' process, specifically targeting behaviors associated with PlugX malware. It monitors for suspicious memory protection changes (e.g., requests for Read-Write-Execute permissions) and the loading of the 'ws2_32.dll' library, which is commonly used to facilitate network communication in side-loaded payloads.