Company
Date Published
Author
Ashkan Hosseini
Word count
3032
Language
-
Hacker News points
None

Summary

Process injection is a prevalent defense evasion method often used in malware and fileless adversary techniques, involving the execution of custom code within another process's address space to enhance stealth and sometimes persistence. The article surveys ten process injection techniques, including Classic DLL Injection, Portable Executable Injection, Process Hollowing, and Thread Execution Hijacking, among others, each with distinct methods of injecting and executing malicious code. These techniques can involve writing code directly into a process or forcing a process to load a malicious library, with methods like DLL injection using function calls such as CreateRemoteThread or LoadLibrary, and more covert approaches like Reflective DLL Injection that do not rely on additional Windows APIs. The article highlights the ongoing development of new techniques by attackers, emphasizing the need for continuous research and adaptation in security solutions, as exemplified by Endgame's work in integrating advanced detection and prevention measures against such techniques.