Alon Weinberg - Please Inject Me: A x64 Code Injection
Introduces a novel x64 code injection technique that bypasses modern Windows security controls without process hollowing.
Summary
Novel x64 Process Injection
Alon Weinberg presents a new code injection technique targeting 64-bit Windows that achieves code execution in arbitrary processes while evading common detection mechanisms.
Injection Without Hollowing
Unlike process hollowing (which unmaps the target executable's image), this technique injects shellcode into the target process's existing mapped sections using reflective loading, avoiding suspicious memory allocation patterns flagged by EDR solutions.
WoW64 and NTDLL Abuse
The technique leverages the WoW64 subsystem's heaven's gate mechanism and direct syscall stubs to bypass userland API hooks commonly deployed by AV/EDR to monitor API calls like VirtualAllocEx and WriteProcessMemory.
Detection and Mitigation
Weinberg provides behavioral detection signatures and discusses kernel-level controls (PatchGuard, Kernel Patch Protection) that could mitigate the technique.
Related talks
Main Stage·48 min
Itzik Kotler
Comprehensive catalog of 15+ Windows process injection techniques with detection signatures and evasion analysis for each.
Main Stage·41 min
Ron Ben-Yizhak · David Shandalov
Stealthy code injection technique using process shimming without registry modifications or on-disk SDB files.
Main Stage·23 min
Bramwell Brizendine · Shiva Shashank Kusuma
Practical methodologies and automation frameworks for executing complex Windows process injection entirely using ROP chains.