Loading story…
Multiple public research reports detailed how attackers can evade Windows security monitoring by abusing native APIs, loader behavior, and application logging. White Knight Labs and XPN documented techniques to suppress or bypass Event Tracing for Windows (ETW) visibility in .NET and Windows processes, while separate research showed that access-mask-based detections can be defeated with DuplicateHandle by first requesting only PROCESS_DUP_HANDLE and then cloning a more privileged handle to targets such as LSASS or winlogon. Microsoft documentation for CreateProcessA also appeared in the reference set because process creation remains central to many payload chains, including shellcode that ultimately launches command shells or follow-on tooling.
Additional reports showed how attackers can blend execution into legitimate Windows behavior and trusted software. iPurple described EntryPoint Hijacking, in which a loaded DLL's entry point is overwritten so malicious code runs during normal thread creation or loader activity, reducing obvious injection signals and complicating EDR detection. NVISO separately analyzed Metasploit reverse-shell shellcode that walks the PEB and resolves APIs such as LoadLibraryA, networking functions, and CreateProcessA, while Hunt & Hackett showed that ConnectWise Control/ScreenConnect can be used for intrusion activity and that its own event logging can be disabled by patching ScreenConnect.Core.dll. Together, the reports underscore that defenders must validate loader integrity, monitor low-visibility handle requests and memory writes, and avoid relying on a single telemetry source such as ETW or application-generated event logs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
iPurple published an analysis of EntryPoint Hijacking, explaining how DLL EntryPoint overwrites can evade EDR by executing through normal loader behavior or thread-pool activity. The article also described LdrShuffleDetect, which reportedly detected all tested hijacking attempts from LdrShuffle, EPI, and a private implementation.
The iPurple article says Hugo Valette presented EntryPoint Hijacking at x33fcon 2025 and released proof-of-concepts named LdrShuffle. The PoCs demonstrated both same-process and remote-process variants and restored modified loader fields to reduce crashes and evade memory scans.
The iPurple article states that Kurosh Dabbagh Escalante released the EPI proof of concept in 2023, documenting abuse of a loaded DLL's EntryPoint to execute attacker-controlled code. EPI patched kernelbase.dll's EntryPoint and used thread-pool execution to run the payload.
Jonathan Johnson published research showing that attackers can request PROCESS_DUP_HANDLE access and then duplicate that handle into one with PROCESS_ALL_ACCESS, bypassing access-mask-based detections and SACL auditing. The article also reported testing that confirmed Cobalt Strike Beacon's default getsystem behavior used this strategy.
White Knight Labs published "Bypassing ETW For Fun and Profit," documenting ETW bypass tradecraft on Windows.
NVISO Labs published an analysis of Metasploit's windows/shell_reverse_tcp shellcode, detailing its import resolution, reverse-shell behavior, and weaknesses in its hashing and module-walking logic. The article also described a proof of concept using a fake DLL export to hijack LoadLibraryA resolution for detection and process termination.
Hunt & Hackett published research on forensic traces and detection opportunities for ConnectWise Control/ScreenConnect, including its use in an incident to upload Mimikatz, Advanced IP Scanner, and ransomware. The article also showed that patching ScreenConnect.Core.dll could suppress ScreenConnect-generated event logs.
The Medium article cites James Forshaw's 2017 blog post "Bypassing SACL Auditing on LSASS" as prior research demonstrating that DuplicateHandle can be used to evade LSASS SACL auditing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
ipurple.team
Open sourcedocs.microsoft.com
Open sourcejsecurity101.medium.com
Open sourcewhiteknightlabs.com
Open sourceblog.nviso.eu
Open sourcehuntandhackett.com
Open sourceblog.xpnsec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate Windows-focused research writeups describe practical **evasion techniques against Microsoft Defender/EDR**. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., `Invoke-Mimikatz`) at runtime using PowerShell character encoding/concatenation (`[char]NN`), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled. A second report covers **EDRStartupHinder**, a newly released tool by researcher **TwoSevenOneT** that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and **Bindlink** redirection of a selected `System32` DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., `MsMpEng.exe`, running as **PPL**) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in `KnownDLLs` and identifying service group order via `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder` and tooling like Process Monitor/Process Explorer boot logs.
Jun 29, 2026
Security research and malware-development writeups detailed a Windows evasion technique that avoids standard loader APIs such as **`GetProcAddress`** and **`GetModuleHandle`** by manually walking the **Process Environment Block (PEB)** and parsing DLL export tables. The approach resolves modules like **`kernel32.dll`** and **`user32.dll`** at runtime, including from encrypted strings, to reduce obvious API references in binaries and make static or behavioral detection more difficult. Microsoft’s documentation for **`GetProcAddress`** provides the baseline behavior that these custom implementations are designed to replace. One proof of concept showed a custom `GetProcAddress` implementation that located **`MessageBoxA`** dynamically on Windows 10 x64, while another demonstrated finding **`kernel32.dll`** in assembly-style code and resolving exports by hash before allocating memory and launching a benign payload with **`CreateThread`**. The authors framed the method as malware and red-team tradecraft, linked it to **MITRE ATT&CK `T1027`**, and noted similarities to techniques seen in **Conti ransomware** source code, underscoring how manual API resolution can help malicious code lower its detection footprint.
Aug 15, 2026
Recent DFIR reporting detailed how investigators can reconstruct attacker activity from Windows and Unix artifacts while avoiding common misreads of legitimate security tooling. Securelist published deep analyses of **UserAssist** and **AmCache**, showing how `shell32.dll` updates GUI execution records, how session statistics and undocumented bytes can reveal usage patterns, and why AmCache can identify executables, drivers, shortcuts, and installed applications even after deletion, despite limits such as SHA-1 hashing only the first `31,457,280` bytes of large files. Separate research showed that **Zsh session files** can preserve command evidence even when `.zsh_history` is deleted, and that binaries wrapped with **shc** or **AutoIT** often remain recoverable or observable through runtime artifacts rather than being truly opaque. Incident write-ups and field notes also showed how attackers and defenders alike can complicate investigations. Analysts documented a typosquatted npm package, **`peritter`**, that dropped `OneDrive.exe` into Startup and stole Chrome credentials; an intrusion in which phishing, Slack installation, RDP access, and Google Drive traffic were tied to document staging and exfiltration; and broader cases in Brazilian educational institutions involving ransomware, valid-account abuse, AnyDesk, PsExec, and insider-planted malware. Other reports warned that legitimate tools and platform features can masquerade as threats or hide them: **NSSM** was used to run payloads such as `ngrok` as Windows services, Azure Batch was abused for cryptomining, RMM cleanup scripts attempted to conceal remote access software, and Microsoft Defender for Endpoint activity including **device discovery** and **Defender XDR deception accounts** generated telemetry that could be mistaken for attacker reconnaissance or privileged account misuse unless investigators validated the underlying configuration and scripts.
Aug 10, 2026