P³-Shellcode Loader

CommandLine Injection: Places the poison in the lpCommandLine parameter of CreateProcessW

The attacker searches for and opens a target process or starts a new process (via OpenProcess / NtOpenProcess or CreateProcess / NtCreateProcess ).

P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure (Process Parameter Poisoning) as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.

Thread Hijacking: Instead of creating a new thread, an existing one is redirected (via NtSetContextThread )

The attacker searches for and opens a target process or starts a new process (via OpenProcess / NtOpenProcess or CreateProcess / NtCreateProcess ).

P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure (Process Parameter Poisoning) as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.

Thread Hijacking: Instead of creating a new thread, an existing one is redirected (via NtSetContextThread )

without triggering common detection mechanisms... Overall, this technique raises much less suspicion as it leaves a smaller fingerprint by using legitimate process creation and thread management APIs.

The third option accepts a path to a DLL file that is then supplied to LoadLibraryA within the target. Lastly, option four loads raw shellcode from a HTTP(S) URL and also takes care of the null byte limitation.

without triggering common detection mechanisms... Overall, this technique raises much less suspicion as it leaves a smaller fingerprint by using legitimate process creation and thread management APIs.

Lastly, option four loads raw shellcode from a HTTP(S) URL and also takes care of the null byte limitation.