New EDR evasion technique proves difficult to detect

As reported by Dark Reading, a newly identified technique for evading endpoint detection and response (EDR) systems has demonstrated a significant ability to bypass security measures, particularly when combined with other evasion methods.

The technique, termed "process parameter poisoning," allows attackers to hide malicious code within the legitimate startup parameters of a Windows process. This bypasses traditional security monitoring that focuses on specific Windows APIs commonly used for process injection, such as VirtualAllocEx(). Flashpoint researchers discovered that by creating a "sacrificial process," attackers can leverage startup parameters to load malicious payloads without triggering alerts from many EDR solutions. Initial tests in July showed success against market-leading EDRs.

Further research by Flashpoint, using a Rust implementation, validated these findings and explored combinations with other evasion tactics like DLL unhooking. When combined, these methods rendered both EDR and XDR components ineffective at detecting the initial execution. While this technique has not yet been observed in public malware, Flashpoint suggests sophisticated threat actors or red teams could employ this technique. Defenders are advised to monitor process behavior, thread execution hijacking, abnormal memory locations, and changes in memory permissions for detection.

Source: Dark Reading