Lost in Transaction: Process Doppelgänging
summary
Introduces Process Doppelgänging, which writes malicious bytes into a file inside an NTFS transaction, creates a memory section from that transacted file, transact, load, rolls the transaction back so disk shows a clean original, then calls legacy section-based process creation (NtCreateProcess/Ex path) to rollback, animate a legitimate-looking process that runs the malicious EXE in-memory. Demonstration runs an AV-flagged tool inside an mspaint doppelganger and Windows Defender on current builds does not detect it; method works on Windows Vista through recent 10 builds and bypasses tested AVs.
AI-written summary · about
chapters (9)
- 0:00Introduction to doppelganger
- 1:05Evasion and injection history
- 11:55AV scanner mechanisms
- 18:26Transacted NTFS overview
- 22:05Windows process loader
- 29:06Process doppelganger workflow
- 32:24Live demo
- 34:24Mitigation and conclusion
- 37:55Q&A session
related talks
40mIn NTDLL I Trust - Process Reimaging and Endpoint Security Solution Bypass
38mDirty Vanity: A New Approach to Code Injection & EDR Bypass
35mThe Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
45mD2T1 - Expanding Your WMI Lateral Movement Arsenal
51mSneaking Past Device Guard
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
55mSpoofing Commands - Can You Trust Process Creation Logs?
25mCommSec D1 - A Deep Dive Into Malicious Documents