diff --git a/host-interaction/process/inject/allocate-user-process-rwx-memory.yml b/host-interaction/process/inject/allocate-user-process-rwx-memory.yml
index d2f4b40a..cd2c3bda 100644
--- a/host-interaction/process/inject/allocate-user-process-rwx-memory.yml
+++ b/host-interaction/process/inject/allocate-user-process-rwx-memory.yml
@@ -12,7 +12,7 @@ rule:
   features:
     - and:
       - match: attach user process memory
-      - match: allocate RWX memory
+      - match: allocate or change RWX memory
       - number: 0xFFFFFFFF = NtCurrentProcess()
       - optional:
         - match: find process by PID
diff --git a/host-interaction/process/inject/hijack-thread-execution.yml b/host-interaction/process/inject/hijack-thread-execution.yml
index 6ecbae26..d60daa4b 100644
--- a/host-interaction/process/inject/hijack-thread-execution.yml
+++ b/host-interaction/process/inject/hijack-thread-execution.yml
@@ -20,7 +20,7 @@ rule:
       - match: suspend thread
       - api: kernel32.GetThreadContext
       - optional:
-        - match: allocate RWX memory
+        - match: allocate or change RWX memory
         - match: write process memory
       - api: kernel32.SetThreadContext
       - match: resume thread
diff --git a/host-interaction/process/inject/inject-dll.yml b/host-interaction/process/inject/inject-dll.yml
index a9276aa1..d1ceb6b8 100644
--- a/host-interaction/process/inject/inject-dll.yml
+++ b/host-interaction/process/inject/inject-dll.yml
@@ -23,7 +23,7 @@ rule:
         - or:
           - match: open process
           - match: host-interaction/process/create
-      - match: allocate RW memory
+      - match: allocate or change RW memory
       - match: write process memory
       - and:
         - or:
diff --git a/host-interaction/process/inject/inject-pe.yml b/host-interaction/process/inject/inject-pe.yml
index 3ce5e81b..333f831e 100644
--- a/host-interaction/process/inject/inject-pe.yml
+++ b/host-interaction/process/inject/inject-pe.yml
@@ -19,7 +19,7 @@ rule:
         - or:
           - match: open process
           - match: host-interaction/process/create
-      - match: allocate RWX memory
+      - match: allocate or change RWX memory
       - basic block:
         - description: virtual address offset calculation
         - and:
diff --git a/host-interaction/process/inject/inject-thread.yml b/host-interaction/process/inject/inject-thread.yml
index 97a66feb..f6e25e16 100644
--- a/host-interaction/process/inject/inject-thread.yml
+++ b/host-interaction/process/inject/inject-thread.yml
@@ -15,8 +15,8 @@ rule:
   features:
     - and:
       - or:
-        - match: allocate RWX memory
-        - match: allocate RW memory
+        - match: allocate or change RWX memory
+        - match: allocate or change RW memory
       - match: write process memory
       - match: create thread
       - optional:
diff --git a/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml b/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml
index 6f8379bf..063c5249 100644
--- a/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml
+++ b/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml
@@ -11,7 +11,7 @@ rule:
       - a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf:0x10001010
   features:
     - and:
-      - match: allocate RWX memory
+      - match: allocate or change RWX memory
       - api: CreateEvent
       - api: CreateThreadpoolWait
       - api: SetThreadpoolWait
diff --git a/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml b/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
index a95f9d2d..bd012419 100644
--- a/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
+++ b/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
@@ -23,7 +23,7 @@ rule:
       - 43db867967c71bd3aaba9a9a3084e7fa:0x140001000
   features:
     - and:
-      - match: allocate RWX memory
+      - match: allocate or change RWX memory
       - or:
         - api: EnumDateFormats
         - api: GrayString
diff --git a/load-code/shellcode/execute-shellcode-via-windows-fibers.yml b/load-code/shellcode/execute-shellcode-via-windows-fibers.yml
index 7524d186..7ff68d7d 100644
--- a/load-code/shellcode/execute-shellcode-via-windows-fibers.yml
+++ b/load-code/shellcode/execute-shellcode-via-windows-fibers.yml
@@ -14,7 +14,7 @@ rule:
       - f03bdb9fa52f7b61ef03141fefff1498ad2612740b1fdbf6941f1c5af5eee70a:0x4026E0
   features:
     - and:
-      - match: allocate RWX memory
+      - match: allocate or change RWX memory
       - api: ConvertThreadToFiber
       - api: CreateFiber
       - api: SwitchToFiber
diff --git a/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml b/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml
index 7920143b..3bdd878b 100644
--- a/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml
+++ b/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml
@@ -12,5 +12,5 @@ rule:
       - Practical Malware Analysis Lab 19-02.exe_:0x401230
   features:
     - and:
-      - match: allocate RWX memory
+      - match: allocate or change RWX memory
       - match: create thread