Shellcode Allocation from Free Memory

api where process.Ext.api.behaviors == "allocate_shellcode" and
 process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 process.thread.Ext.call_stack_summary in
                                ("ntdll.dll
| kernelbase.dll
| Unbacked",
                                 "ntdll.dll
| Unbacked",
                                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| Unbacked") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes like "FREE___*" and not $entry.protection_provenance like ("Kernel", "Kernel
| *")) and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true) and
 not (process.executable : "C:\\Windows\\SysWOW64\\msiexec.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\installer\\msi*.tmp")