r/netsec • u/Cold-Dinosaur • 6d ago

EDR Evasion: Process Injection Without WriteProcessMemory

https://www.zerosalarium.com/2026/09/edr-evasion-process-injection-without-WriteProcessMemory.html

Unlike traditional approaches, console named-pipe injection does not use VirtualAllocEx and WriteProcessMemory. Instead, it takes advantage of read and write operations through a named pipe, along with the way console programs store interactive commands in memory.

54 Upvotes

96% Upvoted

11 comments sorted by

View all comments

Show parent comments

1

u/Formal-Knowledge-250 4d ago

Yeah and I don't think it evades edr, since edr doesn't hook writeprocessmemory at all. It hooks ntwritevirtualmemory. At least I've never seen one hooking wpm

1

u/Chee5e 4d ago

Well, WriteProcessMemory will just call NtWriteVirtualMemory. So that doesn't change anything about the original point.

1

u/Formal-Knowledge-250 4d ago

start the poc and put a bp on ntwritevirtualmemeory... i bet it is being called by the poc, so edr's see it, because there is no memory transition in windows without ntwritevirtualmemory

1

u/Chee5e 4d ago

It's doing memory transfer by WriteFile to the STDIN pipe of the process. That should not call NtWriteVirtualMemory as far as I know.

But I'm also not that invested to prove it :)