Loading story…
A newly published Windows process-injection technique, described as console named-pipe injection, places payload bytes into an interactive console child process through its standard-input named pipe rather than using the heavily monitored VirtualAllocEx and WriteProcessMemory APIs. The proof of concept launches a console application, sends bytes through standard input with WriteFile, identifies the resulting in-process buffer, changes its protection using VirtualProtectEx, and redirects a thread to execute the payload.
The technique is presented for authorized red-team and penetration-testing use, with no reported vulnerability, threat actor, malware campaign, or confirmed in-the-wild exploitation. Defenders should assess detections for remote VirtualProtectEx activity and unusual named-pipe read/write behavior involving console processes—particularly commonly abused binaries such as netsh.exe and nslookup.exe—rather than relying solely on alerts for cross-process memory allocation or WriteProcessMemory.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Research described a Windows process-injection proof of concept that writes payload bytes through a console child process's standard-input named pipe, locates the resulting remote-memory buffer, makes it executable with VirtualProtectEx, and redirects a thread to execute it. The technique avoids VirtualAllocEx and WriteProcessMemory and was presented as an EDR-evasion approach; no confirmed malicious exploitation was reported.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **Process Parameter Poisoning**, a Windows process-injection technique that stores shellcode in process-initialization parameters propagated to a newly created process's Process Environment Block (PEB). Rather than relying on heavily monitored cross-process memory functions such as `WriteProcessMemory` and `VirtualAllocEx`, the technique uses those parameter buffers and thread-execution hijacking to run the payload. Flashpoint validated the method with a Rust proof of concept in a laboratory environment and reported no alerts from tested EDR/XDR products when additional evasion measures were applied. The researchers stressed that this is not evidence of in-the-wild exploitation; defenders should monitor for anomalous or high-entropy process parameters, manipulated thread contexts, execution originating from PEB parameter buffers, and memory-protection changes that render such regions executable.
Sep 22, 2026
Security researchers published a proof-of-concept for **remote function stomping**, a Windows process-injection method that overwrites an existing exported API function inside another process and then runs the injected payload with a remote thread. The demonstration used `notepad.exe` as the target and selected `CallMsgFilterA` from `user32.dll`, resolving the function locally before modifying the remote process with `VirtualProtectEx`, writing shellcode through `WriteProcessMemory`, and triggering execution via `CreateRemoteThread`. The write-up said the technique depends on the target DLL already being loaded in the remote process and noted that **ASLR** can affect DLL base addresses across processes. The authors presented the material as educational for malware researchers, red teams, and defenders, but the compiled sample was reportedly flagged as **suspicious** in an ANY.RUN sandbox, underscoring the detection and abuse potential of the method.
Jul 16, 2026
Researchers disclosed **Process Parameter Poisoning (P³)**, a Windows code-injection technique that stages malicious payloads inside a newly created process by abusing data copied during `CreateProcessW`, including the command line, environment block, and `STARTUPINFO.lpReserved` fields. Instead of relying on heavily monitored APIs such as `WriteProcessMemory` and `VirtualAllocEx`, the technique locates attacker-controlled data through the target process’s **PEB** and `RTL_USER_PROCESS_PARAMETERS`, then prepares it for execution inside the remote process. A public proof of concept, **`p3-loader`** from Orange Cyberdefense, demonstrates redirecting the target process’s main thread with `NtSetContextThread` after changing memory protections, avoiding classic remote-thread creation and reducing common process-injection telemetry. SensePost reported that its implementation executed without alerts across four major EDR products even when process-injection protections were enabled, while both disclosures noted defender opportunities such as monitoring executable protections on process-parameter memory, anomalous process-creation parameters, remote reads of process parameters, and thread-context changes following protection updates.
Jul 8, 2026