Activation Context memory section hijacking

Detects abuses of a legitimate Windows feature present in most processes called Activation Contexts with the objective of loading an arbitrary DLL into signed executables. Adversaries can unmap the legitimate read-only memory section view backing the process Activation Context, then map a new pagefile-backed section at the exact same base address containing a malicious Activation Context.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055

Volver a todas las reglas