PE Injection Payload with NtUnmapViewOfSection

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects potential PE injection payloads over HTTP by looking for the presence of both "NtUnmapViewOfSection" and "VirtualAllocEx" in the file data. These API calls are commonly used in process injection techniques, specifically for unmapping legitimate sections of a process and allocating new memory for malicious code.