SafeBreach researchers have discovered eight new process injection techniques that can be used to covertly execute malicious code on Windows systems.
To stymie EDRs, Leviev and his colleagues found a way to create an execution primitive based on the other two primitives.
The problem, Bar told Help Net Security, is that EDRs base their detection on the identity of the process that performs the action.
Leviev has shared the techniques with the audience at Black Hat Europe last week, and Safebreach has published proof-of-concept code that can be used for further research and development.
SentinelOne confirmed that their products effectively detect and, based on policy settings, terminate this threat on devices protected by their solutions.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Tue, 12 Dec 2023 11:43:19 +0000