Process Reimaging

Created the Friday 08 May 2020. Updated 5 months ago.

Process Reimaging is a technique used to evade detection by endpoint security solutions. It is a variation of the Process Hollowing or Process Doppelganging techniques, which are used to execute arbitrary code in the context of another process.

The Windows operating system has inconsistencies in how it determines the locations of process image FILE_OBJECTs, which can impact the ability of endpoint security solutions, such as Microsoft Defender Realtime Protection, to accurately detect the correct binaries loaded in malicious processes. This inconsistency can be exploited using the Process Reimaging technique, which does not require code injection.

Technique Identifier

U1210

Technique Tags

Process Reimaging Detection evasion Endpoint security solutions Process Hollowing Process Doppelganging Mitre Attack Defense Evasion Category Code injection

Contributors

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

In NTDLL I Trust – Process Reimaging and Endpoint Security Solution Bypass