Injection

2024.03.25 Threadless injection: process execution without creating a thread
Every classic injection technique creates a thread. Threadless injection installs a 5-byte CALL trampoline on an existing function and hijacks the next thread that calls …
windows internals injection evasion malware
2024.01.08 MapViewOfFile2: process injection without WriteProcessMemory
MapViewOfFile2 maps a section object directly into a foreign process without ever calling WriteProcessMemory, removing the cross-process write primitive that most EDR …
windows internals injection evasion malware
2023.10.16 Function stomping: injecting into DLL text instead of heap memory
Classic shellcode injection allocates a private RWX page that every VAD-walking scanner flags. Function stomping overwrites an existing DLL export and executes from …
windows internals injection evasion malware
2023.07.31 Process Injection Without the Obvious Thread: Early Bird APC and Beyond
Why CreateRemoteThread+LoadLibraryA is immediately detectable, how Early Bird APC avoids the worst of the telemetry, and the injection techniques that push further into …
windows malware injection evasion internals