Security researchers have disclosed a process injection technique — and an accompanying evasion stack — that poisons process initialization structures (the Process Environment Block and its associated RTL_USER_PROCESS_PARAMETERS) to smuggle malicious code into a target process without calling the Windows APIs that virtually every EDR on the market hooks. No VirtualAllocEx. No WriteProcessMemory. No CreateRemoteThread / NtCreateThreadEx. That means the telemetry most SOC teams have spent years tuning — Sysmon Event ID 8 (CreateRemoteThread), ETW-Threat-Intelligence, userland hook callbacks — simply never fires.
This matters for one reason above all: the industry's primary injection detection layer is userland API hooking, and this technique deliberately routes around it. If your detection strategy for process injection begins and ends with "watch for cross-process memory writes and remote thread creation," you have a coverage gap that red teams will find before your analysts do. There is no CVE here — this is a technique, not a patchable bug — which makes detection engineering and architectural hardening the only remediation path. Every Windows shop running EDR is affected in principle.
Technical Analysis
How the technique works (defender's view)
Classic process injection has a well-understood signature chain: open a handle to the target (OpenProcess with PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD), allocate memory in the remote process (VirtualAllocEx), write the payload (WriteProcessMemory), and trigger execution (CreateRemoteThread, QueueUserAPC, thread hijacking). EDRs instrument these calls in userland (inline hooks on ntdll.dll / kernel32.dll) and increasingly via ETW-TI kernel callbacks.
The parameter-poisoning approach sidesteps this chain by attacking process creation and initialization instead of a running process:
- Attacker creates a process in a controlled state — typically suspended — giving them a legitimate window to modify its initialization data before the process ever runs.
- Instead of injecting code into a live process, the attacker writes into the target's PEB / process parameter structures (
PEB->ProcessParameters, which holds the command line, image path, DLL search path, environment block, and standard handles). These structures live in memory the process will consume during its own initialization. - By poisoning these fields, the attacker controls what the process believes it is, what it loads, and what executes — achieving code execution inside a legitimate, signed process image without ever issuing a cross-process memory write or remote thread call that an EDR hook would see.
The downstream observable effects defenders can rely on:
- Command-line / image-path mismatch: the process's reported command line (read from the poisoned PEB) no longer matches the actual image on disk (
ProcessImageFileNamefrom kernel telemetry). This is the single highest-fidelity indicator. - Masquerading: the process presents itself to WMI,
Get-CimInstance Win32_Process, and any userland query as something it is not. Tools that read process info from userland structures will report the spoofed identity; kernel-sourced telemetry (Sysmon, Microsoft Defender for Endpoint, ETW) reports the true image. The delta between the two is your detection. - Absent classic injection telemetry: no Sysmon EID 8, no cross-process
WriteProcessMemoryETW-TI events. Silence where you'd expect noise is itself a signal when paired with the mismatch above.
Affected platforms
All supported Windows client and server versions (Windows 10/11, Server 2016–2025). The technique abuses architectural behavior of the Windows process loader and PEB, not a specific versioned defect. EDR products relying primarily on userland hooking for injection detection are the most exposed; products consuming kernel callbacks and ETW-TI retain partial visibility.
Exploitation status
- CVE: None — this is a technique/abuse of intended OS behavior, not a vulnerability. There is nothing to patch.
- CISA KEV: Not applicable.
- Status: Publicly documented research with an operational evasion stack. Historically, techniques of this class (process hollowing, doppelgänging, herpaderping, ghosting) moved from research to commodity malware loaders within 12–18 months. Treat in-the-wild adoption as a near-term certainty and engineer detections now.
Detection & Response
The core detection principle: compare userland-reported process identity (PEB-derived command line) against kernel-reported process identity (image path on disk). Any process whose command line references a different binary than the one actually mapped is exhibiting the exact artifact parameter poisoning produces. Layer this with monitoring for suspended-process creation patterns and continued coverage of classic injection (attackers won't abandon working techniques — they stack them).
Sigma Rules
---
title: Process Command Line and Image Path Mismatch - Possible PEB Parameter Poisoning
id: 3f8a1c94-2b6d-4e71-9a05-7c3d8e2f1b4a
status: experimental
description: Detects process creation where the executable referenced in the command line does not match the actual image path reported by kernel telemetry. This mismatch is a hallmark of PEB/process-parameter tampering used by API-less injection techniques to masquerade as a legitimate process.
references:
- https://www.darkreading.com/endpoint-security/edr-evasion-stack-helps-process-injection-slip-past-defenses
- https://attack.mitre.org/techniques/T1055/
- https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.defense_evasion
- attack.t1055
- attack.t1036
logsource:
category: process_creation
product: windows
detection:
selection_mismatch:
# Sysmon/normalized pipelines that populate OriginalFileName: flag renamed/masqueraded images,
# a common companion artifact when staging a parameter-poisoned process from a dropped binary
OriginalFileName|exists: true
filter_known_unsigned:
Signed: 'false'
condition: selection_mismatch and not filter_known_unsigned
falsepositives:
- Renamed legitimate signed binaries (rare in well-managed environments); validate by comparing Image basename against OriginalFileName in your pipeline
description_note: Tune to alert when Image basename does not equal OriginalFileName-derived expectation; escalate when combined with suspended-child creation or unsigned payloads
level: medium
---
title: Classic Cross-Process Injection Via Remote Thread Creation
id: 8b2e5d17-6f3a-4c82-b91e-2d7a4f6c0e58
status: experimental
description: Detects CreateRemoteThread-style injection (Sysmon EID 8 via process_injection category). Retained as layered coverage — adversaries stacking parameter poisoning with classic techniques, or falling back when the evasion stack fails, will still trip this. Target-Image-aware tuning keeps noise low.
references:
- https://www.darkreading.com/endpoint-security/edr-evasion-stack-helps-process-injection-slip-past-defenses
- https://attack.mitre.org/techniques/T1055/001/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.defense_evasion
- attack.privilege_escalation
- attack.t1055.001
logsource:
category: process_injection
product: windows
detection:
selection_sensitive_target:
TargetImage|endswith:
- '\lsass.exe'
- '\svchost.exe'
- '\explorer.exe'
- '\winlogon.exe'
- '\csrss.exe'
- '\RuntimeBroker.exe'
- '\dllhost.exe'
filter_legit_security_tools:
SourceImage|contains:
- '\Windows Defender\'
- '\Microsoft\EdgeUpdate\'
- 'C:\Program Files\Microsoft Monitoring Agent\'
condition: selection_sensitive_target and not filter_legit_security_tools
falsepositives:
- Legitimate EDR/AV self-injection, application whitelisting agents, debugging tools — baseline your security tooling SourceImages and exclude explicitly
level: high
---
title: Process Created in Suspended State Followed by Resume - Injection Staging Pattern
id: c14d7a29-5e8b-4f60-a372-9b1e6d3c7f02
status: experimental
description: Detects scripting engines and unsigned binaries creating child processes with creation flags or command patterns consistent with suspended-process staging — the setup phase required before process-parameter structures can be poisoned pre-initialization.
references:
- https://www.darkreading.com/endpoint-security/edr-evasion-stack-helps-process-injection-slip-past-defenses
- https://attack.mitre.org/techniques/T1055/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.defense_evasion
- attack.t1055
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
selection_child_system_binary:
Image|endswith:
- '\svchost.exe'
- '\RuntimeBroker.exe'
- '\dllhost.exe'
- '\notepad.exe'
- '\explorer.exe'
condition: all of selection_*
falsepositives:
- Some enterprise software deployment tooling spawns system binaries from script wrappers — tune against your management plane (SCCM, Intune) before production deployment
level: medium
KQL — Microsoft Sentinel / Defender for Endpoint
The highest-fidelity hunt: compare the filename derived from the first token of the process command line against the actual FileName / FolderPath reported by MDE's kernel telemetry. A mismatch means the PEB-derived command line is lying about the true image — exactly what parameter poisoning produces.
// Hunt: PEB parameter poisoning - command line references a different binary than the actual image
// Parses the executable from ProcessCommandLine and compares it to the kernel-reported FileName.
// Mismatch = the process is masquerading its identity (injection / parameter tampering).
let TimeFrame = 24h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where isnotempty(ProcessCommandLine) and ProcessCommandLine != ""
// Extract the first token (the invoked binary), stripping surrounding quotes
| extend FirstTokenRaw = tostring(split(ProcessCommandLine, " ")[0])
| extend FirstToken = trim(@"[\"']", FirstTokenRaw)
// Get the filename from the command-line-referenced path
| extend CmdLineFileName = tostring(split(FirstToken, @"\")[-1])
// Compare against actual on-disk image filename from kernel telemetry
| where CmdLineFileName !~ FileName
// Exclude common benign mismatch patterns (interpreters, app execution aliases, UWP stubs)
| where not(FirstToken has_any ("AppData\\Local\\Microsoft\\WindowsApps"))
| where not(FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe") and CmdLineFileName endswith ".bat")
| extend ActualPath = FolderPath
| project Timestamp, DeviceName, AccountName,
ClaimedBinary = CmdLineFileName,
ActualBinary = FileName,
ActualPath, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
ProcessId, SHA256, ReportId
| sort by Timestamp desc
Supplementary hunt for the staging phase — system binaries spawned suspended-adjacent by script hosts:
// Hunt: script engines spawning masquerade-friendly system binaries (parameter-poisoning staging)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe")
| where FileName in~ ("svchost.exe","RuntimeBroker.exe","dllhost.exe","notepad.exe","explorer.exe","searchprotocolhost.exe")
// Legitimate svchost always carries -k; a bare or odd invocation is suspicious
| where FileName =~ "svchost.exe" and ProcessCommandLine !has "-k"
or FileName in~ ("RuntimeBroker.exe","dllhost.exe","notepad.exe","searchprotocolhost.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by Timestamp desc
Velociraptor VQL
Endpoint triage artifact that walks the live process list, parses each process's PEB-reported command line, and compares the claimed binary against the kernel-reported executable path. This catches a poisoned process while it is running, without relying on EDR hook telemetry.
-- Artifact: PEB.CommandLine.Vs.KernelImage
-- Purpose: Find running processes whose PEB-reported command line claims a
-- different executable than the kernel-reported image path — the on-host
-- artifact of process parameter poisoning / PEB tampering.
LET procs = SELECT Pid, PPid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine AND Exe
LET parsed = SELECT Pid, PPid, Name, Username, CreateTime,
Exe AS KernelImage,
basename(path=Exe) AS KernelImageName,
CommandLine,
-- first whitespace-delimited token, quotes stripped
regex_replace(re=`^["']?([^"'\s]+)["']?.*`, source=CommandLine, replace=`$1`) AS ClaimedPath,
basename(path=regex_replace(re=`^["']?([^"'\s]+)["']?.*`, source=CommandLine, replace=`$1`)) AS ClaimedImageName
FROM procs
SELECT Pid, PPid, Username, CreateTime,
KernelImage, ClaimedPath,
KernelImageName, ClaimedImageName,
CommandLine
FROM parsed
WHERE ClaimedImageName != KernelImageName
-- reduce interpreter noise: cmd/bash launching scripts is normal
AND NOT (KernelImageName =~ `(?i)^(cmd|powershell|pwsh|wscript|cscript)\.exe$`
AND ClaimedPath =~ `(?i)\.(bat|cmd|ps1|vbs|js)$`)
-- WindowsApps execution aliases resolve to different backing images
AND NOT ClaimedPath =~ `(?i)WindowsApps`
Remediation / Hardening Script
This PowerShell script (run elevated) performs three jobs: (1) sweeps live processes for the command-line/image mismatch indicator, (2) verifies command-line auditing and kernel telemetry prerequisites are enabled, and (3) checks Defender tamper protection and ASR posture relevant to injection defense.
#requires -RunAsAdministrator
# Security Arsenal - PEB Parameter Poisoning Hunt & Hardening Script
# 1) Sweep live processes for command-line vs actual-image mismatches
# 2) Verify command-line process auditing (Event 4688 enrichment) is enabled
# 3) Verify Microsoft Defender tamper protection and key ASR mitigations
Write-Host "`n=== [1] Live Process Identity Mismatch Sweep ===" -ForegroundColor Cyan
$suspect = @()
Get-CimInstance Win32_Process | ForEach-Object {
$cl = $_.CommandLine
$exe = $_.ExecutablePath
if ([string]::IsNullOrWhiteSpace($cl) -or [string]::IsNullOrWhiteSpace($exe)) { return }
# First token of command line, quotes stripped
$first = ($cl -split ' ')[0] -replace '^["'']|["'']$',''
$claimedName = [IO.Path]::GetFileName($first)
$actualName = [IO.Path]::GetFileName($exe)
# Skip interpreters launching scripts and WindowsApps aliases
if ($claimedName -and $actualName -and ($claimedName -ne $actualName)) {
if ($claimedName -match '\.(bat|cmd|ps1|vbs|js)$') { return }
if ($first -match 'WindowsApps') { return }
$suspect += [PSCustomObject]@{
PID = $_.ProcessId
ClaimedBinary = $claimedName
ActualBinary = $actualName
ActualPath = $exe
CommandLine = $cl
}
}
}
if ($suspect) {
Write-Host "[!] MISMATCHED PROCESS IDENTITIES FOUND - investigate immediately:" -ForegroundColor Red
$suspect | Format-List
$suspect | Export-Csv ".\PEB_Mismatch_Findings_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation
} else {
Write-Host "[+] No live process identity mismatches detected." -ForegroundColor Green
}
Write-Host "`n=== [2] Command-Line Process Auditing (4688) Check ===" -ForegroundColor Cyan
$aclKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
$aclVal = (Get-ItemProperty -Path $aclKey -Name 'ProcessCreationIncludeCmdLine_Enabled' -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled
if ($aclVal -eq 1) {
Write-Host "[+] Process creation command-line auditing is ENABLED." -ForegroundColor Green
} else {
Write-Host "[-] Enabling process creation command-line auditing..." -ForegroundColor Yellow
New-Item -Path $aclKey -Force | Out-Null
Set-ItemProperty -Path $aclKey -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1 -Type DWord
Write-Host "[+] Enabled. 4688 events will now include command lines." -ForegroundColor Green
}
Write-Host "`n=== [3] Defender Tamper Protection & ASR Posture ===" -ForegroundColor Cyan
$tp = (Get-MpComputerStatus).IsTamperProtected
if ($tp) { Write-Host "[+] Tamper Protection: ON" -ForegroundColor Green }
else { Write-Host "[!] Tamper Protection: OFF - enable via Intune/Defender portal (required to prevent EDR neutering)." -ForegroundColor Red }
# ASR rule: Block process creations from PSExec/WMI (lateral injection staging) - audit mode check
$asrRules = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids -ErrorAction SilentlyContinue
$asrActions = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions -ErrorAction SilentlyContinue
if ($asrRules) {
Write-Host "[+] ASR rules configured: $($asrRules.Count). Review actions for Block vs Audit." -ForegroundColor Green
} else {
Write-Host "[-] No ASR rules configured. Recommend enabling ASR in Audit, then Block for:" -ForegroundColor Yellow
Write-Host " d1e49aac-8f56-4280-b9ba-993a6d77406c (Block process creations from PSExec/WMI)" -ForegroundColor Yellow
Write-Host " c1db55ab-c21a-4637-bb3f-a12568109d35 (Block executable content from email/webmail)" -ForegroundColor Yellow
}
Write-Host "`n=== Sweep complete. Forward any mismatch findings to IR before killing processes (memory capture first). ===" -ForegroundColor Cyan
Remediation
There is no patch — this is architectural. Remediation is detection coverage plus reducing the attack surface the evasion stack depends on.
- Close the identity-mismatch gap today. Deploy the KQL and VQL hunts above into scheduled analytics. The claimed-vs-actual image filename comparison is the single most reliable artifact this technique leaves behind, and it requires no new telemetry — MDE and Sysmon already collect both fields.
- Verify your EDR's telemetry architecture. Ask your vendor, in writing: does injection detection rely solely on userland hooks, or does it consume ETW-TI (Threat Intelligence) kernel callbacks and kernel process-create notifications? Products with kernel-sourced telemetry retain the image-path ground truth that defeats PEB masquerading. Escalate gaps to your vendor roadmap conversations and contract renewals.
- Enable and centralize command-line auditing. The PowerShell script above enables
ProcessCreationIncludeCmdLine_Enabled; ensure 4688 events with command lines flow to your SIEM. Poisoned parameters are only useful to an attacker if defenders can't compare them against ground truth. - Harden against the staging phase. Enforce Attack Surface Reduction rules (start in Audit, move to Block):
d1e49aac-8f56-4280-b9ba-993a6d77406c(process creations from PSExec/WMI) and child-process restrictions for Office and script hosts. Constrain who can create suspended processes from script interpreters via App Control for Business (WDAC) where feasible. - Protect the protectors. Confirm tamper protection is enabled tenant-wide (Intune: Endpoint Security > Antivirus > Tamper Protection). An evasion stack that avoids EDR hooks is frequently paired with an attempt to disable the EDR outright; tamper protection is the control that survives.
- Exercise the gap. Have your red team or a purple-team engagement replicate the published technique in a lab and measure your time-to-detect against the detections above. If the mismatch hunt is your only tripwire, that's acceptable — but verify it fires before assuming coverage.
- IR playbook update. Add a step to your process-injection playbook: before terminating a suspect process, capture memory (Velociraptor
Windows.Memory.Acquisitionorprocdump -ma) — with API-less injection, the in-memory evidence is the only forensic record of what was injected, since no allocation/write telemetry exists.
The broader lesson for 2026 detection engineering: userland API hooking is a deprecating foundation. Every investment you make this year in kernel-sourced telemetry, identity-correlation detections, and memory forensics capability pays off against this technique class and the ones that follow it.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.