Process Injection

Bypassing Endpoint Security by Process Injection

Process Injection is a sophisticated technique used by attackers to inject malware code into the memory of running processes.

• By injecting code into a running process, malware can evade detection using security software that often overlooks the monitoring of the internal state of every process for such changes.
• This technique can be part of a larger strategy employed by attackers to maintain persistence, escalate privileges, or perform other malicious activities without being detected.

Key Functions for Process Injection

Process injection attacks can be performed through Windows API functions, such as:

1. VirtualAllocEx():

   • This function allocates memory within the address space of the target process. Attackers call VirtualAllocEx() to reserve a block of memory in the target process where they can inject their malicious payload.

2. WriteProcessMemory():

   • This function is used to write data into the memory space of a remote process, including the injection of malicious code. After allocating memory to the target process using VirtualAllocEx(), the attacker calls WriteProcessMemory() to write a malicious payload into the allocated memory space.

3. CreateRemoteThread():

   • This function creates a new thread in the address space of the target process. After writing the malicious payload into the memory space of the target process, the attacker calls CreateRemoteThread() to create a remote thread within the target process and directs it to execute the injected code.