tweak malfind's injection filter - the criteria it uses to detect potentially malicious memory segments. fixes Issue #278

volatility/plugins/malware/malfind.py

@@ -152,9 +152,22 @@ class MalwareEPROCESS(windows._EPROCESS):
         contain injected code. 
         """
         protect = vadinfo.PROTECT_FLAGS.get(vad.u.VadFlags.Protection.v(), "")
+        write_exec = "EXECUTE" in protect and "WRITE" in protect
 
-        return (vad.u.VadFlags.PrivateMemory == 1 and "EXECUTE" in protect and
-                "WRITE" in protect and vad.Tag == "VadS")
+        # The Write/Execute check applies to everything 
+        if not write_exec:
+            return False 
+
+        # This is a typical VirtualAlloc'd injection 
+        if vad.u.VadFlags.PrivateMemory == 1 and vad.Tag == "VadS":
+            return True 
+
+        # This is a stuxnet-style injection 
+        if (vad.u.VadFlags.PrivateMemory == 0 and 
+                protect != "PAGE_EXECUTE_WRITECOPY"):
+            return True
+
+        return False
 
     def _mapped_file_filter(self, vad):
         """