Hunt for code injection in memory — classic injection, reflective loaders, process hollowing, APC injection, and thread hijacking. Use after triage flags a suspect process or when the IoC set mentions injection TTPs.
