New Windows Process Injection Technique Bypasses EDR Monitoring Without WriteProcessMemory
Researchers disclosed a Windows console-pipe injection method that avoids WriteProcessMemory and VirtualAllocEx.
Researchers disclosed console named-pipe injection, a Windows process-injection method that moves data into a child console process through redirected standard input instead of the commonly monitored VirtualAllocEx and WriteProcessMemory APIs. The write-up says the injector still changes memory protection in the child and redirects a thread, so single-API alerts can miss it. Certain console control characters can break delivery. The article cites earlier SensePost work on process-parameter poisoning and urges correlation of unusual console launches, pipe writes, remote executable-memory changes, and thread-context edits.
- The method avoids VirtualAllocEx and WriteProcessMemory for payload delivery.
- Remote protection changes and thread redirection remain detectable signals.
- Console control characters can disrupt delivery through standard input.
- Defenders should correlate pipes, memory protection, and thread context.
From the original article
3 min read at gbhackers.com
A newly disclosed method for Windows process injection utilizes redirected console input and named pipes to transfer payload data into a child process without invoking the heavily monitored APIs VirtualAllocEx and WriteProcessMemory.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.