Tag: process-injection

Exploring Process Injection OPSEC – Part 2

In Part 1, we reviewed the very simple VirtualAllocEx/WriteProcessMemory/CreateRemoteThread injection pattern. The two major OPSEC concern(s) that it had was both an RX memory region and an executing thread that were not backed by a module on disk. In this part, we’ll fix the “thread” issue by replacing the use of CreateRemoteThread with QueueUserAPC. The

Read more

Exploring Process Injection OPSEC – Part 1

This is the first in a short series of posts designed to explore common (remote) process injection techniques and their OPSEC considerations. Each part will introduce a different technique that will address one or more “weaknesses” previously identified. This post will analyse the most classical method of injection – the VirtualAllocEx/WriteProcessMemory/CreateRemoteThread pattern; and assumes the

Read more