Process Parameter Poisoning Evades EDR by Hiding Payloads in Windows PEB Data

Researchers disclosed Process Parameter Poisoning, a Windows process-injection technique that stores shellcode in process-initialization parameters propagated to a newly created process's Process Environment Block (PEB). Rather than relying on heavily monitored cross-process memory functions such as WriteProcessMemory and VirtualAllocEx, the technique uses those parameter buffers and thread-execution hijacking to run the payload.

Flashpoint validated the method with a Rust proof of concept in a laboratory environment and reported no alerts from tested EDR/XDR products when additional evasion measures were applied. The researchers stressed that this is not evidence of in-the-wild exploitation; defenders should monitor for anomalous or high-entropy process parameters, manipulated thread contexts, execution originating from PEB parameter buffers, and memory-protection changes that render such regions executable.