Process Injection: Перехват выполнения потока
Other sub-techniques of Process Injection (12)
Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.
Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL. A handle to an existing victim process is first created with native Windows API calls such as OpenThread
. At this point the process can be suspended then written to, realigned to the injected code, and resumed via SuspendThread
, VirtualAllocEx
, WriteProcessMemory
, SetThreadContext
, then ResumeThread
respectively.(Citation: Elastic Process Injection July 2017)
This is very similar to Process Hollowing but targets an existing process rather than creating a process in a suspended state.
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process.
Примеры процедур |
|
Название | Описание |
---|---|
Waterbear |
Waterbear can use thread injection to inject shellcode into the process of security software.(Citation: Trend Micro Waterbear December 2019) |
Gazer |
Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017) |
Trojan.Karagany |
Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the |
Контрмеры |
|
Контрмера | Описание |
---|---|
Behavior Prevention on Endpoint |
Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. |
Обнаружение
Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as CreateRemoteThread
, SuspendThread
/SetThreadContext
/ResumeThread
, and those that can be used to modify memory within another process, such as VirtualAllocEx
/WriteProcessMemory
, may be used for this technique.(Citation: Elastic Process Injection July 2017)
Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.
Ссылки
- Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.
- Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.
- ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
- Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.
- Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.
Связанные риски
Риск | Связи | |
---|---|---|
Закрепление злоумышленника в ОС из-за
возможности захвата потока выполнения (thread) легитимного процесса в ОС Windows
Повышение привилегий
НСД
|
|
|
Обход систем защиты из-за
возможности захвата потока выполнения (thread) легитимного процесса в ОС Windows
Повышение привилегий
Целостность
|
|
Каталоги
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.