This repository is for investigation of Windows process execution techniques. Most of PoCs are given a name corresponding to the technique.

• BlockingDLL : This toolset is for testing blocking DLL process. See README.md.

• CommandLineSpoofing : This PoC performs Command Line Spoofing. This technique may not work for Windows 11.

• GhostlyHollowing : This PoC performs Ghostly Hollowing.

• PPIDSpoofing : This PoC performs PPID Spoofing.

• ProcessDoppelgaenging : This PoC performs Process Doppelgänging. Due to kernel protection improvement, this technique does not work for recent Windows OS (> Windows 10 Version 1809, as far as I tested). See the issue for hasherezade's repository.

• ProcessGhosting : This PoC performs Process Ghosting. This technique may not work for Windows 11 after 22H2.

• ProcessHerpaderping : This PoC performs Process Herpaderping. Due to file lock issue, if you choose a fake image file smaller than you want to execute, file size shrinking will be failed and corrupt file signature for herpaderping process. To take full advantage of this technique, fake image file size should be larger than you want to execute. This technique may not work for Windows 11 after 22H2.

• ProcessHollowing : This PoC performs Process Hollowing. Unlike the original, the PE image is parsed into a new memory area instead of using ZwUnmapViewOfSection / NtUnmapViewOfSection.

• ProcMemScan : This is a diagnostic tool to investigate remote process. See README.md.

• ProcMemScan : This toolset is for testing ProtectedProcess. See README.md.

• SdDumper : This tool is to dump and analyze SecurityDescriptor information. See README.md.

• TransactedHollowing : This PoC performs Transacted Hollowing.

• WmiSpawn : This PoC tries to spawn process with WMI. The processes will be spawn as child processes of WmiPrvSE.exe. Supports local machine process execution and remote machine process execution. The usage can see README.md.

NOTE : Currently ProcessHollowing code does not works for Debug build. To test it, use Release build. See this issue.

• https://www.ired.team/offensive-security/defense-evasion/preventing-3rd-party-dlls-from-injecting-into-your-processes

• https://crypt0ace.github.io/posts/Staying-under-the-Radar/

• https://offensivedefence.co.uk/posts/ntcreateuserprocess/

• https://attack.mitre.org/techniques/T1564/010/

• https://blog.nviso.eu/2020/02/04/the-return-of-the-spoof-part-2-command-line-spoofing/

• https://attack.mitre.org/techniques/T1134/004/

• https://www.hackingarticles.in/parent-pid-spoofing-mitret1134/

• https://www.picussecurity.com/resource/blog/how-to-detect-parent-pid-ppid-spoofing-attacks

• https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing

• https://blog.nviso.eu/2020/01/31/the-return-of-the-spoof-part-1-parent-process-id-spoofing/

• https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf

• https://attack.mitre.org/techniques/T1055/013/

• https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/

• https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack

• https://www.hackingarticles.in/process-ghosting-attack/

• https://github.com/jxy-s/herpaderping

• https://jxy-s.github.io/herpaderping/

• https://www.hackingarticles.in/process-herpaderping-mitret1055/

• https://attack.mitre.org/techniques/T1055/012/

• https://www.ired.team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations

• https://github.com/hasherezade/transacted_hollowing

• Unknown Known DLLss

• Unreal Mode : Breaking Protected Processes

• The Evolution of Protected Processes – Part 1: Pass-the-Hash Mitigations in Windows 8.1

• The Evolution of Protected Processes Part 2: Exploit/Jailbreak Mitigations, Unkillable Processes and Protected Services

• Protected Processes Part 3 : Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs & Runtime Signers)

• Debugging Protected Processes

• Protecting Windows protected processes

• Relevance of Security Features Introduced in Modern Windows OS

Thanks for your research:

• Tal Liberman (@tal_liberman)

• Eugene Kogan (@EuKogan)

• hasherezade (@hasherezade)

• Gabriel Landau (@GabrielLandau)