Loading story…
Researchers disclosed Process Parameter Poisoning (P³), a Windows code-injection technique that stages malicious payloads inside a newly created process by abusing data copied during CreateProcessW, including the command line, environment block, and STARTUPINFO.lpReserved fields. Instead of relying on heavily monitored APIs such as WriteProcessMemory and VirtualAllocEx, the technique locates attacker-controlled data through the target process’s PEB and RTL_USER_PROCESS_PARAMETERS, then prepares it for execution inside the remote process.
A public proof of concept, p3-loader from Orange Cyberdefense, demonstrates redirecting the target process’s main thread with NtSetContextThread after changing memory protections, avoiding classic remote-thread creation and reducing common process-injection telemetry. SensePost reported that its implementation executed without alerts across four major EDR products even when process-injection protections were enabled, while both disclosures noted defender opportunities such as monitoring executable protections on process-parameter memory, anomalous process-creation parameters, remote reads of process parameters, and thread-context changes following protection updates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SensePost published details on Process Parameter Poisoning (P3), a code-injection technique that uses Windows process startup parameters to place malicious code into a newly created process without relying on commonly monitored APIs such as WriteProcessMemory and VirtualAllocEx. The write-up says the implementation injected code without alerts across four leading EDR products and discusses limitations, a shellcode generator, and possible detection opportunities.
Orange Cyberdefense published the P³-Shellcode Loader proof of concept, describing a code-injection technique that abuses Windows process creation parameters in the PEB and ProcessParameters structures to stage and execute shellcode while avoiding common process-injection telemetry.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
sensepost.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers published a proof-of-concept for **remote function stomping**, a Windows process-injection method that overwrites an existing exported API function inside another process and then runs the injected payload with a remote thread. The demonstration used `notepad.exe` as the target and selected `CallMsgFilterA` from `user32.dll`, resolving the function locally before modifying the remote process with `VirtualProtectEx`, writing shellcode through `WriteProcessMemory`, and triggering execution via `CreateRemoteThread`. The write-up said the technique depends on the target DLL already being loaded in the remote process and noted that **ASLR** can affect DLL base addresses across processes. The authors presented the material as educational for malware researchers, red teams, and defenders, but the compiled sample was reportedly flagged as **suspicious** in an ANY.RUN sandbox, underscoring the detection and abuse potential of the method.
Jul 16, 2026
Two separate Windows-focused research writeups describe practical **evasion techniques against Microsoft Defender/EDR**. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., `Invoke-Mimikatz`) at runtime using PowerShell character encoding/concatenation (`[char]NN`), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled. A second report covers **EDRStartupHinder**, a newly released tool by researcher **TwoSevenOneT** that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and **Bindlink** redirection of a selected `System32` DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., `MsMpEng.exe`, running as **PPL**) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in `KnownDLLs` and identifying service group order via `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder` and tooling like Process Monitor/Process Explorer boot logs.
Jun 29, 2026
Blackpoint Cyber reported an intrusion at an industrial organization in which attackers deployed **PCHunter64.exe** from the unusual path `C:\PerfLogs`, alongside **AnyDesk**, **FileZilla**, **MASSCAN**, and **RDP** activity across seven endpoints. Investigators observed failed `ADMIN$` share mount attempts by two user accounts on one machine, indicating attempted lateral movement, and Blackpoint said it isolated affected systems within minutes before issuing remediation guidance. The incident underscores continued abuse of legitimate or allowlisted Windows administration and remote-access tools in operational environments. Sandbox analysis of **PCHunter64** shows the tool can go well beyond administration, including dropping signed driver components, creating Windows service registry entries such as `PCHUNTER64`, loading kernel drivers, deleting **SafeBoot** registry keys, and exhibiting anti-debugging and anti-VM behavior. The activity aligns with MITRE ATT&CK persistence techniques including **Windows Service** creation or modification (`T1543.003`) and boot or logon autostart execution (`T1547.008`), while additional indicators pointed to credential-access behavior, including an artifact consistent with **LSASS** minidump collection. Together, the references show how a dual-use utility can be weaponized for persistence, defense evasion, and deeper compromise inside Windows environments.
Jul 19, 2026