Activation Context memory section hijacking

Detects abuses of a legitimate Windows feature present in most processes called Activation Contexts with the objective of loading an arbitrary DLL into signed executables. Adversaries can unmap the legitimate read-only memory section view backing the process Activation Context, then map a new pagefile-backed section at the exact same base address containing a malicious Activation Context.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055

Back to all rules