In NTDLL I Trust - Process Reimaging and Endpoint Security Solution Bypass
summary
Claim: Process Reimaging lets an attacker with code execution make the OS report the wrong backing EXE by renaming file path, so Defender and many AVs query legacy NTDLL/kernel fields and see a trusted binary instead. The team builds a proof-of-concept PoC that simply renames directories or filenames (no code injection) and reliably bypasses Windows Defender on multiple Windows versions; Windows 10 gets a partial fix for filenames only, EDR/memory tracing still detects it.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 1:11What is process reimaging
- 4:41Attack vectors and variants
- 15:31Kernel APIs and inconsistencies
- 26:06Live demo walkthrough
- 34:58Demo results and impact
- 36:23Protection and mitigation strategies
- 39:14Conclusion and Q&A
related talks
49mLost in Transaction: Process Doppelgänging
38mDirty Vanity: A New Approach to Code Injection & EDR Bypass
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
39mDefender-Pretender: When Windows Defender Updates Become a Security Risk
29mRendering Ransomware Detection and EDR Products Blind
36mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
58mRed Team Techniques for Evading, Bypassing & Disabling MS
41mSimulation Hacking, the Good, Bad and the Ugly