Using process creation as a case study, this research will outline the evasion-detection arms race to date, describe the weaknesses in some current detection approaches and then follow the quest for a generic approach to LRPC-based evasion.

A Brief History of Child Process Evasion

Detecting LRPC provenance

LRPC event volumes

Correlating RPC server calls with their clients

Correlating RPC server calls and resultant behavior

Introducing ETW’s ActivityId

What would Microsoft do?

Conclusion

Effective Parenting - detecting LRPC-based parent PID spoofing

In this blog, we will demonstrate how to detect each of four classes of process trampolining and release an updated PowerShell detection script – Get-InjectedThreadEx

CreateThread() overview

1 - Bring your own trampoline

2 - Shifting the trampoline mat

3 - If it walks like a trampoline, and it talks like a trampoline...

4 - It's literally already a trampoline

Hunting suspicious thread creations

Wrapping up

Get-InjectedThreadEx – Detecting Thread Creation Trampolines

Author

John Uhlmann

Articles

Effective Parenting - detecting LRPC-based parent PID spoofing

Get-InjectedThreadEx – Detecting Thread Creation Trampolines