Modify Authentication Process: Hybrid Identity

Defense Evasion [Mitre]

Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.

Many organizations maintain hybrid user and device identities that are shared between on-premises and cloud-based environments. These can be maintained in a number of ways. For example, …

Process Injection: Dynamic-link Library Injection

Defense Evasion [Mitre]

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.

DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process …

Process Injection: Portable Executable Injection

Defense Evasion [Mitre]

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.

PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the …

Process Injection: Thread Execution Hijacking

Defense Evasion [Mitre]

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.

Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced …

Process Injection: Asynchronous Procedure Call

Defense Evasion [Mitre]

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.

APC injection is commonly performed by attaching malicious code to the APC Queue of a …

Process Injection: Thread Local Storage

Defense Evasion [Mitre]

Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.

TLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process …

Process Injection: Extra Window Memory Injection

Defense Evasion [Mitre]

Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.

Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate …

Process Injection: Process Hollowing

Defense Evasion [Mitre]

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. …

Process Injection: Process Doppelgänging

Defense Evasion [Mitre]

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.

Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. To ensure data …

Process Injection: ListPlanting

Defense Evasion [Mitre]

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate …

Search For Content

Search Result

Modify Authentication Process: Hybrid Identity

Defense Evasion [Mitre]

Process Injection: Dynamic-link Library Injection

Defense Evasion [Mitre]

Process Injection: Portable Executable Injection

Defense Evasion [Mitre]

Process Injection: Thread Execution Hijacking

Defense Evasion [Mitre]

Process Injection: Asynchronous Procedure Call

Defense Evasion [Mitre]

Process Injection: Thread Local Storage

Defense Evasion [Mitre]

Process Injection: Extra Window Memory Injection

Defense Evasion [Mitre]

Process Injection: Process Hollowing

Defense Evasion [Mitre]

Process Injection: Process Doppelgänging

Defense Evasion [Mitre]

Process Injection: ListPlanting

Defense Evasion [Mitre]