Itzik Kotler - Process Injection Techniques: Gotta Catch Them All
Comprehensive catalog of 15+ Windows process injection techniques with detection signatures and evasion analysis for each.
Summary
Windows Process Injection Taxonomy
Itzik Kotler (CTO and co-founder, SafeBreach) presents a comprehensive taxonomy of Windows process injection techniques, providing detection guidance and evasion analysis for each.
Taxonomy Coverage
The talk covers 15+ techniques: DLL injection, reflective DLL injection, process hollowing (RunPE), process doppelgänging, atom bombing, hook injection, APC injection, thread execution hijacking, manual mapping, and lesser-known variants using WMI, COM, and ETW consumers.
Detection Analysis
For each technique, Kotler analyzes which API calls are required, which Windows event log entries are generated, and which behavioral patterns can be detected by EDR solutions — providing a practical detection coverage matrix.
Evasion Evolution
The talk traces the adversarial evolution of injection techniques in response to improved detection, showing how each new injection variant was developed specifically to evade the detection mechanisms added for its predecessor.
Related talks
Main Stage·26 min
Tarek Abdelmotaleb · Bramwell Brizendine
Tarek Abdelmotaleb and Dr. Bramwell Brizendine demonstrate weaponizing Windows syscalls into pure position-independent shellcode, evading modern EDR hooks.
Main Stage·18 min
Alon Weinberg
Introduces a novel x64 code injection technique that bypasses modern Windows security controls without process hollowing.
Main Stage·41 min
Ron Ben-Yizhak · David Shandalov
Stealthy code injection technique using process shimming without registry modifications or on-disk SDB files.