Thread context set from unbacked memory

Identifies manipulation of the thread context from unbacked memory region. This may be indicative of process injection.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055

Back to all rules