New Windows Process Injection Attack Evades EDR Monitoring Without WriteProcessMemory
Researcher details Windows console named-pipe injection that avoids VirtualAllocEx and WriteProcessMemory EDR checks.
Security researcher Two Seven One Three disclosed console named-pipe injection, a Windows process-injection method that avoids VirtualAllocEx and WriteProcessMemory. An injector starts a console child such as nslookup.exe or netsh.exe, writes the payload through a redirected standard-input pipe, locates a marker in memory, calls VirtualProtectEx to make those pages executable, then suspends a thread and redirects its instruction pointer. A demonstration found 368 bytes inside nslookup.exe and changed the region from read-write to executable. Payloads must omit carriage return, line feed, and Ctrl+Z, and the write-up urges correlation of creation, handles, protection changes, and thread context rather than single-API alerts.
- Console named-pipe injection sends payload bytes through a child process stdin pipe.
- It avoids VirtualAllocEx and WriteProcessMemory, then marks existing pages executable.
- A demo found 368 bytes in nslookup.exe and redirected its main thread.
- Payloads cannot include carriage return, line feed, or Ctrl+Z bytes.
- Defenders should correlate process creation, pipes, VirtualProtectEx, and thread context changes.
From the original article
3 min read at cybersecuritynews.com
A Windows process injection method disclosed by security researcher Two Seven One Three sidesteps two APIs closely associated with remote code injection: VirtualAllocEx and WriteProcessMemory. Dubbed console named-pipe injection, the technique delivers payload bytes through a child console process’s redirected standard input and repurposes memory Windows has already populated.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.