A novel Windows process injection technique, revealed by security researcher Two Seven One Three, successfully bypasses traditional EDR monitoring tools. This method cleverly avoids using the typical VirtualAllocEx and WriteProcessMemory APIs known for remote code injection activities.
Innovative Process Injection Method
Named console named-pipe injection, this technique cleverly utilizes a child console process’s redirected standard input to deliver payloads. By repurposing memory that Windows has already allocated, it sidesteps detection systems reliant on the conventional allocate-write-execute pattern.
Process injection, a method where arbitrary code is executed within another process, disguises potentially harmful activities as legitimate application operations. The MITRE ATT&CK framework categorizes this behavior as T1055, highlighting its commonality in cybersecurity incidents.
Mechanics of the Technique
Instead of direct cross-process memory writing, this approach leverages Windows interprocess communication. The injector initiates an interactive console child process, such as nslookup.exe, redirects its standard input to a named pipe, and transmits the payload using WriteFile.
According to Microsoft, a parent process can configure a pipe’s read end as a child’s standard-input handle, retaining the write end. This setup allows the payload to reside in the console program’s address space, where it processes input. The method includes prefixing the payload with a unique marker to locate it in memory and calculating the entry point for execution.
Security Implications and Recommendations
Security expert Two Seven One Three demonstrated a proof of concept where 368 bytes were located in an nslookup.exe region, transforming its protection status from read-write to executable-read-write. This involved suspending and resuming threads with modified instruction pointers.
To effectively counteract this threat, defenders should shift focus from single-API alerts to a comprehensive behavioral analysis. Key indicators include unusual parent processes launching interactive console binaries, binary-like input writes, memory scanning, and remote VirtualProtectEx transitions.
Security teams are advised to baseline console automation activities and scrutinize rare event combinations. This strategic shift aims to enhance detection capabilities beyond typical process-parameter manipulation.
Ultimately, this research underscores the need for robust detection tools that consider process creation, handle sharing, memory protection, and control flow changes, ensuring a multi-faceted approach to cybersecurity.
