Examples and Real World Scenarios

1) Process Injection Monitoring:

• VirtualAllocEx, WriteProcessMemory, CreateRemoteThread are flagged.

• EDR logs the full injection chain and arguments (target PID, buffer, size).

2) Fileless Execution Monitoring:

• EDRs detect PowerShell invoking encoded commands via -enc flag.

• API call patterns + command-line arguments = detection logic.

3) Network Activity:

• Calls to WSAConnect, connect, or HttpSendRequest are monitored.

• EDR may intercept arguments to see destination IP/domain.

Real-World Scenario

Scenario: A malware performs process hollowing by:

1. Creating a suspended process.

2. Unmapping the target image.

3. Writing shellcode.

4. Resuming the thread.

Monitored API Calls:

CreateProcess, NtUnmapViewOfSection, WriteProcessMemory, ResumeThread.

EDR Response:

• Flags unusual call sequence + memory permissions.

• Real-time alert or post-event correlation triggered.

Evasion Tactic:

Use syscall-level injection, avoid known API calls, use delay and obfuscation.