EDR Evasion Stack Helps Process Injection Slip Past Defenses

Summary

A novel technique for injecting code into running processes, dubbed 'process parameter poisoning,' has been identified. This method bypasses traditional Endpoint Detection and Response (EDR) solutions by manipulating process initialization structures without invoking common Windows APIs that EDR tools monitor, making it harder to detect.

Entities