Potential shellcode injection via Windows Debugging API

Identifies shellcode injection using the Windows Debugging API and shared memory section. Attackers avoid writing and reading remote memory directly, instead employ context manipulation to force the target process to load and execute the payload itself via shared file mapping.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055

Back to all rules