Process Injection: Внедрение списков
Other sub-techniques of Process Injection (12)
Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.
List-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings are stored within the process' memory in a SysListView32
control.
ListPlanting (a form of message-passing "shatter attack") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32
child of the victim process window (via Windows API calls such as FindWindow
and/or EnumWindows
) or other Process Injection methods.
Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory
function. For example, an adversary can use the PostMessage
and/or SendMessage
API functions to send LVM_SETITEMPOSITION
and LVM_GETITEMPOSITION
messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020)
Finally, the payload is triggered by sending the LVM_SORTITEMS
message to the SysListView32
child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems
callback.
Примеры процедур |
|
Название | Описание |
---|---|
InvisiMole |
InvisiMole has used ListPlanting to inject code into a trusted process.(Citation: ESET InvisiMole June 2020) |
Контрмеры |
|
Контрмера | Описание |
---|---|
Behavior Prevention on Endpoint |
Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. |
Обнаружение
Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as FindWindow
, FindWindowEx
, EnumWindows
, EnumChildWindows
, and those that can be used to modify memory within another process, such as VirtualAllocEx
/WriteProcessMemory
, may be abused for this technique.
Consider monitoring for excessive use of SendMessage
and/or PostMessage
API functions with LVM_SETITEMPOSITION
and/or LVM_GETITEMPOSITION
arguments.
Analyze process behavior to determine if a process is performing unusual actions, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.
Ссылки
- Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
- odzhan. (2019, April 25). Windows Process Injection: WordWarping, Hyphentension, AutoCourgette, Streamception, Oleum, ListPlanting, Treepoline. Retrieved November 15, 2021.
- Microsoft. (2021, May 25). About List-View Controls. Retrieved January 4, 2022.
Связанные риски
Каталоги
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.