AN0838
Analytic 0838
Windows
Detect anomalous chains of memory allocation and execution inside the same process (e.g., VirtualAlloc → memcpy → VirtualProtect → CreateThread). Unlike process injection, reflective code loading does not perform cross-process memory writes — the suspicious activity occurs entirely within the process’s own PID context.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
etw:Microsoft-Windows-DotNETRuntime
AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime
etw:Microsoft-Antimalware-Scan-Interface
Amsi/Script content + API verdicts during in-memory staging
WinEventLog:Sysmon
EventCode=10
[ParentProcessWhitelist]
Certain processes may legitimately use Assembly.Load(); defenders may whitelist known developer/admin tools.
[MemoryRegionPermissions]
Detection logic can tune for RWX memory allocations; some legitimate tools may allocate with RW permissions only.
AN0839
Analytic 0839
Linux
Monitor for in-process mmap + mprotect + execve/execveat activity where memory permissions are changed from writable to executable inside the same process without a corresponding ELF on disk.
auditd:SYSCALL
execve
auditd:MMAP
memory region with RWX permissions allocated
[ProcessNameScope]
Uncommon for service binaries to call memfd_create; detection tuned for high-risk processes.
[RWXMemoryThreshold]
Adjust threshold for allowed RWX allocations to reduce false positives in JIT runtimes.
AN0840
Analytic 0840
macOS
Suspicious calls to dlopen(), dlsym(), or mmap with RWX flags in processes that do not typically perform dynamic module loading. Monitor anonymous memory regions executed by user processes.
macos:unifiedlog
execve or dylib load from memory without backing file
macos:unifiedlog
suspicious dlopen/dlsym usage in non-development processes
[ApplicationScope]
Developer tools may legitimately call dlopen/dlsym; narrow scope to production workloads.
[ExecutionTimeWindow]
Correlate suspicious loads with subsequent process activity in a defined window.