Early Cascade Injection: From Windows process creation to stealthy injection

Great! We have been working on Windows Process (and COM) injection since 2003 [1][2][3]. I need to talk with the current development team about reviewing it with the EDR-Preloading technique. We have a driver also that suspends a new process before hooking it, we also hook existing processes.<p>Business-wise our work on this went down once Microsoft Detours was made FOSS even when our products has other capabilities. A good old thread is here [4].<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;nektra&#x2F;Deviare2">https:&#x2F;&#x2F;github.com&#x2F;nektra&#x2F;Deviare2</a><p>[2] <a href="https:&#x2F;&#x2F;github.com&#x2F;nektra&#x2F;Deviare-InProc">https:&#x2F;&#x2F;github.com&#x2F;nektra&#x2F;Deviare-InProc</a><p>[3] <a href="https:&#x2F;&#x2F;github.com&#x2F;nektra&#x2F;RemoteBridge">https:&#x2F;&#x2F;github.com&#x2F;nektra&#x2F;RemoteBridge</a><p>[4] <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;22crn0&#x2F;gpl_alternative_library_to_microsoft_detours_for&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;22crn0&#x2F;gpl_alt...</a>

Not all overriding and detouring is malicious. For instance, Steam detours Direct3D every time you launch a game in order to set up the steam overlay.

I&#x27;m surprised the call to WriteProcessMemory or creating suspended processes isn&#x27;t being picked up, it usually gets you a lot of points on the &quot;Detect binary as malware heuristic&quot; detector

This is a great writeup, thanks for posting it. The post mentions Early Bird APC is a fairly recent development, around 2018, but process injection has been around for a long time. Is there any theoretical work being done towards locking down processes against injection in more robust ways than simply making sure there is no temporal chance to inject a malicious code? I’m thinking something along the lines of CFI, but for processes instead of subroutines, would be useful if it could be made to work.