Ten Process Injection Techniques

[Deleted member 178]

Process injection is a widespread defense evasion technique employed often within malware and fileless adversary tradecraft, and entails running custom code within the address space of another process. Process injection improves stealth, and some techniques also achieve persistence. Although there are numerous process injection techniques, in this blog I present ten techniques seen in the wild that run malware code on behalf of another process. I additionally provide screenshots for many of these techniques to facilitate reverse engineering and malware analysis, assisting detection and defense against these common techniques.

Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques

 

[Deleted member 178]

Classic Anti-exe won't protect against those attacks, for that you need some kind of memory protection feature.

 

[HarborFront]

Classic Anti-exe won't protect against those attacks, for that you need some kind of memory protection feature.

So can recommend some software to protect against those mentioned 10 process injection techniques?

Thanks

 

[Deleted member 178]

Appguard , Comodo (in some extent, its BB has Shellcode Injection protection feature), some AV suites, HMPA, etc..

 

[Sunshine-boy]

Also Malwarebytes anti exploit free

 

[shmu26]

Anti-exe with vulnerable processes protection will generally nip these exploits in the bud. It can't stop the exploit once it starts, but it can stop the attack from beginning in the first place.

 

[Deleted member 178]

Anti-exe with vulnerable processes protection will generally nip these exploits in the bud. It can't stop the exploit once it starts, but it can stop the attack from beginning in the first place.

not against fileless attacks like Reflective DLL Injections.
Anti-exe are out of the game against memory attacks.

 

[Sunshine-boy]

DLL Injections.

how can we stop it? smart object blocker?

 

[Deleted member 178]

how can we stop it? smart object blocker?

no , Reflectine dll injection is the dll being modified in memory , not a dll being executed.
read my post above to know what may block memory attacks.

 

[HarborFront]

Anti-exe with vulnerable processes protection will generally nip these exploits in the bud. It can't stop the exploit once it starts, but it can stop the attack from beginning in the first place.

So can VS or SecureAPlus do it? Can't find a feature to protect vulnerable processes.

Thanks

 

[Deleted member 178]

So can VS or SecureAPlus do it? Can't find a feature to protect vulnerable processes.
Thanks

The thread is about memory attacks , VS won't react , it doesn't have memory protection features; however if the said attacks use executables or vulnerable processes (Windows Processes commonly used by malwares), VS should block them.

 

[Sunshine-boy]

read my post above to know what may block memory attacks.

I know anti exploit softwares can block these attacks.from what I read Malwarebytes anti exploit(free) can block memory attack but Idk how effective Malwarebytes is, that's why I asked.

 

[Deleted member 178]

I know anti exploit software can block these attacks.from what I read Malwarebytes anti epxloit(free) can block memory attack)but Idk how effective Malwarebytes is, that's why I asked.

Some people said that MBAE is now integrated in MBAM, you should check.
MBAM can't block memory attacks

 

[shmu26]

not against fileless attacks like Reflective DLL Injections.
Anti-exe are out of the game against memory attacks.

My point is like this: what is doing the injecting? How did it get into the system?
I admit that anti-exe will not always protect against advanced worms that spread laterally through a network, but that is not a threat that home users face.
Barring network worms, the fileless attack will not be able to do damage unless it can abuse a vulnerable process. So just protect those processes, and you are safe.

 

[HarborFront]

My point is like this: what is doing the injecting? How did it get into the system?
I admit that anti-exe will not always protect against advanced worms that spread laterally through a network, but that is not a threat that home users face.
Barring network worms, the fileless attack will not be able to do damage unless it can abuse a vulnerable process. So just protect those processes, and you are safe.

You want to recommend NVT ERP? But is NVT ERP still in development?

NVT ERP -- mark vulnerable process as safe parent process?

Thanks

 

[shmu26]

You want to recommend NVT ERP? But is NVT ERP still in development?

NVT ERP -- mark vulnerable process as safe parent process?

Thanks

AFAIK, any good anti-exe should do the job for a home user.
These are some decent options:
1 NVT ERP, despite lack of development, still does the job
2 VoodooShield
3 ReHIPS
4 Kaspersky with tweaks
5 Comodo with either containment or HIPS
6 SpyShelter with proper settings

By the way, that thread of mine, which you linked to, I asked that question when I was trying out ERP for the first time, and I didn't yet understand how it works. The other posters set me straight.

 

[509322]

You want to recommend NVT ERP? But is NVT ERP still in development?

NVT ERP -- mark vulnerable process as safe parent process?

Thanks

Yes, it is still being developed.

 

[HarborFront]

AFAIK, any good anti-exe should do the job for a home user.
These are some decent options:
1 NVT ERP, despite lack of development, still does the job
2 VoodooShield
3 ReHIPS
4 Kaspersky with tweaks
5 Comodo with either containment or HIPS
6 SpyShelter with proper settings

By the way, that thread of mine, which you linked to, I asked that question when I was trying out ERP for the first time, and I didn't yet understand how it works. The other posters set me straight.

Does VS specify a list of vulnerable processes for the user like NVT ERP? Otherwise how to get VS to do it?

 

[shmu26]

Does VS specify a list of vulnerable processes for the user like NVT ERP? Otherwise how to get VS to do it?

With VS it is all hard-coded. Ask @Umbra, but I think you can rely on Dan to do the job right with the vulnerable processes. Based on what I have seen, VS handles them well.

 

[Deleted member 178]

My point is like this: what is doing the injecting? How did it get into the system?

There is many vector attacks, and many don't use any file dropped on the HDD, so what an anti-exe will do? basically nothing...

I admit that anti-exe will not always protect against advanced worms that spread laterally through a network, but that is not a threat that home users face.

The topic is about process injections not home user threats or not. stay on topic.

Barring network worms, the fileless attack will not be able to do damage unless it can abuse a vulnerable process. So just protect those processes, and you are safe.

You need to do some more researches about attack vectors, your understanding of attacks is too limited to exe and vulnerable processes.
Do you know that you can load cmd/powershell scripts without the use of powershell.exe or cmd.exe ?
Also, what about dlls, libraries, etc... ?