AN0250
Analytic 0250
Windows
Behavioral chain involving suspicious use of GetProcAddress and LoadLibrary following memory allocation and manual mapping, often paired with low entropy strings, abnormal API use without static import tables, or delayed module load behaviors.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
etw:Microsoft-Windows-Kernel-Process
API tracing / stack tracing via ETW or telemetry-based EDR
[APILoadWithoutImport]
Tunable logic to flag suspicious modules used without static IAT entries
[TimeWindow]
Correlates module load to suspicious memory allocation or API lookup within timeframe
[EntropyThreshold]
Used to detect obfuscated strings or hashed function names
[StackTraceFilter]
Optional filtering of known safe modules or patterns from telemetry