Skip Navigation

Memory protection violation types

Exploitation Violation Types

Applies to	Violation
Windows macOS	Stack Pivot — The stack for a thread has been replaced with a different stack. Generally the system will only allocate a single stack for a thread. An attacker would use a different stack to control execution in a way that is not blocked by Data Execution Prevention (DEP).
Windows macOS	Stack Protect — The memory protection of a thread’s stack has been modified to enable execution permission. Stack memory should not be executable, so usually this means that an attacker is preparing to run malicious code stored in stack memory as part of an exploit, an attempt which would otherwise be blocked by Data Execution Prevention (DEP).
Windows	Overwrite Code — Code residing in a process’s memory has been modified using a technique that may indicate an attempt to bypass Data Execution Prevention (DEP).
Windows	RAM Scraping — A process is trying to read valid magnetic stripe track data from another process. This is typically related to point of sale systems (POS).
Windows	Malicious Payload — A generic shellcode and payload detection associated with exploitation has been detected.

Process Injection Violation Types

Applies to	Violation
macOS	Remote Allocation of Memory — A process has allocated memory in another process. Most allocations will only occur within the same process. This generally indicates an attempt to inject code or data into another process, which may be a first step in reinforcing a malicious presence on a system.
Windows	Remote Mapping of Memory — A process has introduced code and/or data into another process. This may indicate an attempt to begin executing code in another process and thereby reinforce a malicious presence.
Windows macOS	Remote Write To Memory — A process has modified memory in another process. This is usually an attempt to store code or data in previously allocated memory (see OutOfProcessAllocation) but it is possible that an attacker is trying to overwrite existing memory in order to divert execution for a malicious purpose.
Windows	Remote Write PE To Memory — A process has modified memory in another process to contain an executable image. Generally this indicates that an attacker is attempting to execute code without first writing that code to disk.
Windows	Remote Overwrite Code — A process has modified executable memory in another process. Under normal conditions executable memory will not be modified, especially by another process. This usually indicates an attempt to divert execution in another process.
Windows	Remote Unmap of Memory — A process has removed a Windows executable from the memory of another process. This may indicate an intent to replace the executable image with a modified copy for the purpose of diverting execution.
Windows macOS	Remote Thread Creation — A process has created a new thread in another process. A process’s threads are usually only created by that same process. This is generally used by an attacker to activate a malicious presence that has been injected into another process.
Windows	Remote APC Scheduled — A process has diverted the execution of another process’s thread. This is generally used by an attacker to activate a malicious presence that has been injected into another process.
macOS	DYLD Injection — An environment variable has been set that will cause a shared library to be injected into a launched process. Attacks can modify the plist of applications like Safari or replace applications with bash scripts, that cause their modules to be loaded automatically when an application starts.

Escalation Violation Types

Applies to	Violation
Windows	LSASS Read — Memory belonging to the Windows Local Security Authority process has been accessed in a manner that indicates an attempt to obtain users’ passwords
Windows macOS	Zero Allocate — A null page has been allocated. The memory region is typically reserved, but in certain circumstances it can be allocated. Attacks can use this to setup privilege escalation by taking advantage of some known null de-reference exploit, typically in the kernel.