There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. 

Is it possible for a process to somehow detect if it has been injected by another process using winapi? If so, how?

More specifically, are there any "fixed/likely" characteristics of injected code? For instance, from [this question][1] it appears that injected code can be characterized by always appearing in pages that have the following protection flags set: PAGE_READWRITE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_WRITECOPY and possibly (but unlikely) PAGE_EXECUTE. Can you point out other characteristics of injected code?


  [1]: http://reverseengineering.stackexchange.com/questions/3482/does-code-injected-into-process-memory-always-belong-to-a-page-with-rwx-access