Detecting Injection: The API Trail

• Watch cross-process API combinations, especially in sequence:
• OpenProcess with strong rights on an unrelated process.
• VirtualAllocEx with PAGE_EXECUTE_READWRITE.
• WriteProcessMemory into another process.
• CreateRemoteThread / QueueUserAPC / SetThreadContext.
• Individually benign; together, in order, they are a strong injection signal.
• Memory scanning: private, executable, non-image-backed regions (RWX with no file behind them) are suspicious.