The use of memory injection techniques for nefarious purposes has now become common place in many real world compromises being used by both low and high sophistication attackers. In this talk I'll discuss ways in which defenders can begin to detect such anomalies at scale and the challenges involved.