process-memory-protect

April 24, 2024 · View on GitHub

Description

Virtual memory was protected

Parameters

ParameterValue
Subjectprocess
Activitymemory-protect
Activity Typeprocess-memory-protect
Pretty NameProcess Memory Protect

Fields

The possible fields for this activity type will vary depending on whether the activity was a success or a fail.

process-memory-protect:success

FieldCoreDetectionInformational
memory_address✓
memory_size✓
memory_protection✓

process-memory-protect:fail

FieldCoreDetectionInformational
failure_code✓
memory_address✓
failure_reason✓
memory_size✓
memory_protection✓