Process Parameter Poisoning Evades EDR by Injecting Code via Windows Startup Data

Researchers disclosed Process Parameter Poisoning (P³), a Windows code-injection technique that stages malicious payloads inside a newly created process by abusing data copied during CreateProcessW, including the command line, environment block, and STARTUPINFO.lpReserved fields. Instead of relying on heavily monitored APIs such as WriteProcessMemory and VirtualAllocEx, the technique locates attacker-controlled data through the target process’s PEB and RTL_USER_PROCESS_PARAMETERS, then prepares it for execution inside the remote process.

A public proof of concept, p3-loader from Orange Cyberdefense, demonstrates redirecting the target process’s main thread with NtSetContextThread after changing memory protections, avoiding classic remote-thread creation and reducing common process-injection telemetry. SensePost reported that its implementation executed without alerts across four major EDR products even when process-injection protections were enabled, while both disclosures noted defender opportunities such as monitoring executable protections on process-parameter memory, anomalous process-creation parameters, remote reads of process parameters, and thread-context changes following protection updates.