ERAAgent.exe write-then-execute shellcode injection (SLEEPWALKER RUN_SHELLCODE)

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•1

This rule detects potentially malicious memory manipulation and thread execution activity originating from the ERAAgent.exe process. It specifically identifies when ERAAgent.exe calls VirtualProtect or VirtualAlloc to set memory as PAGE_EXECUTE_READWRITE, followed shortly by a CreateThread or CreateRemoteThread operation. This behavior is indicative of process injection or reflective code loading, where an executable image is manually mapped into memory and executed, bypassing traditional file-based detection.