Mockingjay Process Injection Technique Could Let Malware Evade Detection

[vtqhtr413]

Content source

https://thehackernews.com/2023/06/new-mockingjay-process-injection.html

A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. "The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers Thiago Peixoto, Felipe Duarte, and Ido Naor said in a report shared with The Hacker News. "The uniqueness of this technique is that it requires a vulnerable DLL and copying code to the right section."

Process injection is an attack method that allows adversaries to inject code into processes in order to evade process-based defenses and elevate privileges. In doing so, it could allow for the execution of arbitrary code in the memory space of a separate live process. Some of the well-known process injection techniques include dynamic link library (DLL) injection, portable executable injection, thread execution hijacking, process hollowing, and process doppelgänging, among others.

 

[silversurfer]

 

[Sandbox Breaker - DFIR]

God damn it! Another technique. This will make crappy analyst's more crappy... And good ones better. Thanks for sharing this!

 

[Kongo]

Sorry if I missed it, but it isn't yet exploited in the wild. Right?

 

[Sandbox Breaker - DFIR]

Sorry if I missed it, but it isn't yet exploited in the wild. Right

It will be if not so.

APC can't even be so called "patched"