How Hackers & Malware Spoof Processes
Source: YouTube · John Hammond · published Jul 27, 2023 · 25:57
The video demonstrates parent process ID spoofing as a malware evasion technique to bypass security defenses 0:00.
Key Takeaways:
• Malware naturally runs in hostile environments with security defenses like antivirus and EDR that need to be evaded 0:03
• Parent process ID spoofing makes malware appear to be launched from legitimate processes like explorer.exe rather than the actual malicious process 3:11
• The technique involves creating an extended startup info structure, building an attribute list, and stealing information from a legitimate process 14:51
• The demonstration shows C/C++ code that successfully launches notepad.exe but makes it appear as if explorer.exe is the parent process 19:44
• The proof of concept is verified using Process Explorer, which shows notepad.exe appearing under explorer.exe rather than the actual malware process 21:21
The technique can be extended beyond explorer.exe and is just one of many evasion methods security professionals can use to test defensive capabilities.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
computer malware naturally runs in a hostile environment you've got antivirus you've got EDR you've got all these other security mechanisms and defenses fighting to detect or prevent and stop malware from running and rightfully so right because it's malware but if you are a security researcher sometimes you want to see that malware in action or if you're a penetration tester or an ethical hacker or red teamer at threat emulation team you want to run and write and make malware so your malware needs to get around to these defensive Technologies it needs to bypass it it needs to circumvent it it needs to evade things like antivirus EDR and all these things that are in the way you need a little bit of evasion in your toolkit and in this video I want to show you one of the ways that you could d…