Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 120,
    "key": "propagate",
    "unprotect_id": "U1214",
    "name": "Propagate",
    "description": "This technique involves modifying the internal properties of a window in order to intercept and modify or monitor the behavior of the window when it receives messages. To do this, an application creates a buffer containing shellcode and injects it into the target process. \r\n\r\nThen, it modifies the internal structure used by the specific properties, such as UxSubclassInfo and CC32SubclassInfo, to point to the payload. \r\n\r\nFinally, the application modifies the property of the window. When a message is sent to the window, the shellcode is executed. This technique is known as Window Subclassing and is often used by adversaries to achieve persistence or execute malicious code.",
    "resources": "http://www.hexacorn.com/blog/2017/10/26/propagate-a-new-code-injection-trick/",
    "creation_date": "2019-03-23T17:32:45Z",
    "tags": "Window Subclassing, Windows functionality, internal structure, UxSubclassInfo, CC32SubclassInfo, shellcode, target process, payload, message, injection",
    "modification_date": "2023-10-04T10:42:30.209000Z",
    "category": [
        4
    ],
    "rules": [],
    "attachments": [],
    "featured_api": [
        290
    ],
    "contributors": []
}