Windows Socket Creation from Unbacked Memory

api where process.Ext.api.name == "VirtualProtect" and
 process.Ext.api.metadata.target_address_name == "mswsock.dll" and
 process.thread.Ext.call_stack_summary in ("ntdll.dll
| apphelp.dll
| ntdll.dll
| kernelbase.dll
| ws2_32.dll
| Unbacked",
                                           "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| apphelp.dll
| ntdll.dll
| kernelbase.dll
| ws2_32.dll
| Unbacked") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "Unbacked*" and $entry.callsite_trailing_bytes : "?*") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "c:\\windows\\sys?????\\ws2_32.dll!WSASocket*") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like ("c:\\windows\\microsoft.net\\framework64\\v*\\clr.dll", "c:\\program files\\dotnet\\shared\\microsoft.netcore.app\\*\\coreclr.dll")