3 - Process Injection / Memory Evasion

Table of Content

Process Injection Techniques

Must Check - Awesome Injection [Updated and Well categorised] : https://github.com/itaymigdal/awesome-injection

Classic Injection ( CreateRemoteThread , RtlCreateUserThread, NtCreateThreadEx )
Thread Context (SetThreadContext)
Sections and Views
Asynchronous Procedure Calls ( QueueUserAPC , NtQueueApcThread )
- https://www.ired.team/offensive-security/code-injection-process-injection/apc-queue-code-injection
EarlyBird APC
- Rust EarlyBird APC Injection : https://github.com/c2pain/RustBird
Module Stomping
- https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
- https://github.com/countercept/ModuleStomping
Thread Hijacking
- https://www.ired.team/offensive-security/code-injection-process-injection/injecting-to-remote-process-via-thread-hijacking
- https://github.com/connormcgarr/cThreadHijack
Process Hollowing
- https://github.com/m0n0ph1/Process-Hollowing
- https://www.darkrelay.com/post/demystifying-hollow-process-injection
- https://www.ired.team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations
Process Doppelganging
- https://github.com/3gstudent/Inject-dll-by-Process-Doppelganging
- https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/
Transacted Hollowing
- https://github.com/hasherezade/transacted_hollowing
Process Herpanderping
- https://jxy-s.github.io/herpaderping/
- https://github.com/jxy-s/herpaderping
Process Ghosting
- https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack
- https://github.com/hasherezade/process_ghosting
Process Hypnosis
- https://github.com/CarlosG13/Process-Hypnosis-Debugger-assisted-control-flow-hijack
- https://infosecwriteups.com/process-hypnosis-debugger-assisted-control-flow-hijack-9c34ce3e6ed7
Dirty Vanity
- https://github.com/deepinstinct/Dirty-Vanity
- Combination of multiple Techniques with Dirty Vanity : https://github.com/Offensive-Panda/DV_NEW
Mockingjay
- https://github.com/caueb/Mockingjay
- https://github.com/ewby/Mockingjay_POC
- https://github.com/oldboy21/JayFinder
- https://gist.github.com/thefLink/5054f3cd35ff05e0aa028459d2ef57b9
- Hunting and injecting RWX 'mockingjay' DLLs in pure nim : https://github.com/nbaertsch/Shrike
Pool Party Process Injection
- https://github.com/SafeBreach-Labs/PoolParty
- PoolParty BOF : https://github.com/0xEr3bus/PoolPartyBof
Threadless Process Injections
- Entry Point Injection - EPI : github.com/Kudaes/EPI
- DllNotification Injection : github.com/Dec0ne/DllNotificationInjection
- Threadless Inject - Threatless Injection Using remote Function Hooking : https://github.com/CCob/ThreadlessInject/tree/master
- Using HWBP and Dynamic API code to perform threadless injection - Conferences/Defcon31 at main · OtterHacker/Conferences · GitHub
- Patchless Threadless Injection Via Hardware BreakPoints [ Maldev Academy ]
Code injection in a PPL Process without vulnerable driver : https://blog.slowerzs.net/posts/pplsystem/
Process Injection Using Thread Name [ Hazerezade ] : https://github.com/hasherezade/thread_namecalling
- https://research.checkpoint.com/2024/thread-name-calling-using-thread-name-for-offense/
Kernelcallback table process injection : https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html
Caro-Kann - Encrypted shellcode Injection in remote process to avoid Kernel triggered memory scans : https://github.com/S3cur3Th1sSh1t/Caro-Kann
Conhost Injection : https://modexp.wordpress.com/2018/09/12/process-injection-user-data/
- Check improved version by S3cur3Th1sSh1t on patreon
  - Code here :
    
    ConhostInject-main.zip
24 Process Injection Techniques : https://github.com/7etsuo/windows-api-function-cheatsheets?tab=readme-ov-file#table-of-contents
Early Cascade Injection : https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/
- https://github.com/Cracked5pider/earlycascade-injection
- https://github.com/m4ul3r/malware/tree/main/nim/earlycascade_injection
- https://github.com/Whitecat18/earlycascade-injection
- https://github.com/Cracked6appybara/EarlyCascade
- https://github.com/jnabnsn/Early-Cascade
- https://github.com/0xsp-SRD/0xsp.com/tree/main/cascade_injection
- https://github.com/0xNinjaCyclone/EarlyCascade
- To find address of g_ShimsEnabled and g_pfnSE_DllLoaded .
  - https://x.com/m4ul3r_0x00/status/1856362500310143174?s=46&t=mlJvZy0Zrkrxzuvtt7m2cQ
KernelCallbackTable Injection : https://github.com/0xHossam/KernelCallbackTable-Injection-PoC
Process Snapshotting : https://github.com/Teach2Breach/snapinject_rs
Other Process Injection Techniques
- HookChain (PE Loader, Remote Injection) : https://github.com/helviojunior/hookchain
- https://github.com/dis0rder0x00/ParentProcessManipulation-LNK
- https://github.com/JanielDary/ImmoralFiber
- IconJector - Windows Explorer DLL injection technique that uses the change icon dialog on Windows : https://github.com/0xda568/IconJector
- Divide and Conquer
  - https://github.com/Kudaes/Split
  - https://github.com/Maldev-Academy/Christmas/
- Sektor7 - RtlRemoteCall to execute shellcode in remote process - https://www.alex-ionescu.com/rtlremotecall/ or https://institute.sektor7.net/view/courses/rto-maldev-adv1/1514778-custom-rpc/4841383-apireekall-calling-any-api-in-remote-process
- Hunt for RWX in a process - Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region : https://github.com/Offensive-Panda/RWX_MEMEORY_HUNT_AND_INJECTION_DV
- Hollow - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode : https://github.com/boku7/HOLLOW
- https://github.com/CICADA8-Research/IHxExec
  - https://cicada-8.medium.com/process-injection-is-dead-long-live-ihxhelppaneserver-af8f20431b5d
[Must Check] Repos with List of many Process Injection Techniques
- [BEST] Awesome Injection [Updated and Well categorised] : https://github.com/itaymigdal/awesome-injection
- Collection of Process Injection Techniques : https://github.com/hideckies/malsrc/tree/94de00fd2151cb3c9d811c9e49a3bec642d3f264/Injection
- Comprehensive process injection series : https://offensive-panda.github.io/ProcessInjectionTechniques/
- 24 Process Injection Techniques : https://github.com/7etsuo/windows-api-function-cheatsheets?tab=readme-ov-file#table-of-contents
- https://github.com/theevilbit/injection/tree/master
Research Blogs / Papers / Talks
- Windows Process Injection in 2019 : https://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All-wp.pdf
- https://youtu.be/_TEnBLt2JF4?si=TWHUl-AOOGTXx4Qr
More Resources and Techniques Can be found here
- https://github.com/MahmoudZohdy/Process-Injection-Techniques
- Code Injection Techniques : https://github.com/matthieu-hackwitharts/Win32_Offensive_Cheatsheet/blob/main/README.md#code-injection-techniques
- Process Injection Workshop : https://github.com/RedTeamOperations/Advanced-Process-Injection-Workshop
  - PDF-1 : https://cyberwarfare.live/wp-content/uploads/2023/08/ProcessInjection-v2-Event-1.pdf
  - PDF-2 (Better) : https://github.com/An0nUD4Y/Advanced-Process-Injection-Workshop/blob/master/CWL Process Injection Workshop - v2.pdf