EDR Evasion Stack Helps Process Injection Slip Past Defenses
Researchers at Flashpoint have discovered a new EDR evasion technique called "process parameter poisoning" that allows attackers to inject malicious code into process initialization structures without triggering alerts from endpoint detection and response (EDR) systems. The technique involves exploiting a method where attackers can inject code into process initialization structures without using traditional Windows APIs monitored by EDR tools. Combining this with DLL unhooking and policy restrictions further enhances evasion capabilities, and while not yet seen in public malware samples, it poses a significant risk to advanced threat actors.
Researchers at Flashpoint have discovered a new EDR evasion technique called "process parameter poisoning" that allows attackers to inject malicious code into process initialization structures without triggering alerts from endpoint detection and response (EDR) systems. The technique involves exploiting a method where attackers can inject code into process initialization structures without using traditional Windows APIs monitored by EDR tools. These APIs include (but are not necessarily limited to) VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2().
Researchers at Flashpoint discovered a way for an attacker already executing code on a Windows system to create a "sacrificial process" and abuse the startup parameters Windows automatically transfers into that new process. This is all done without using some of the memory allocation and write operations that EDR products traditionally monitor for process injection.
Back in July, researchers Max Hirschberger and Ogulcan Ugur tested the strategy against four unspecified market-leading EDR offerings, and said in their blog post at the time that "code injection succeeded in all cases and no alerts were created, even though the EDRs were configured to detect, block and remediate."
Flashpoint's researchers built and tested their own implementation of the technique in Rust in order to assess how it might be able to circumvent certain endpoint detection mechanisms. Flashpoint's work independently validates the original research while exploring how the technique behaves when implemented in Rust and combined with additional evasion measures.
In this case, Flashpoint tested the base technique through its Rust POC against a commonly used open source EDR platform with an extended detection and response (XDR) component. The EDR platform failed to produce any alerts from executing the binary, but the XDR component blocked subsequent activity by the second-stage payload.
Researchers then combined the basic technique with DLL unhooking, an evasion technique that can restore Windows library functions modified by security software, potentially bypassing some user-mode EDR monitoring. Flashpoint also applied a policy to block non-Microsoft DLLs, which can make it harder for certain third-party EDR monitoring components to load.
After this point, "Analysts observed no blocks from the XDR during execution and observed no alerts on the platform," the researchers wrote.
Flashpoint identified four detection strategies for defenders to protect themselves against process parameter poisoning: inspect process parameters for anomalous data; monitor for thread execution hijacking; detect code executing from abnormal memory locations; and watch for memory permissions being changed to executable.
Paul Daubman, senior analyst at Flashpoint, tells Dark Reading that the security firm hasn't identified evidence of it being used in public malware samples to date, "but there's nothing really stopping the threat actors from using it." "It's similar to process parameter spoofing, which is a well-known technique yet still not often used in samples," he says. "As such, we don't expect it to be widely used outside of dedicated red teams or sophisticated threat actors."