Spoofing Commands - Can You Trust Process Creation Logs?
summary
Attacks overwrite the process environment block to replace the logged command line after a process is created suspended, so Windows, Sysmon and Defender XDR record a spoofed command line while the real command runs; demonstrations show built-in tools, PowerShell cmdlets and encoded commands can be hidden. Enterprise EDRs catch roughly 50% of tests, a student rewrite in C bypasses EDRs, and Microsoft declines a servicing fix so this affects Windows, Sysmon and Defender XDR visibility.
AI-written summary · about
chapters (10)
- 0:00Command line spoofing in Windows
- 1:59What spoofing does
- 3:24Attackers using spoofed commands
- 12:13Process creation logs deep dive
- 23:19Vulnerable command types
- 31:49Windows tools spoofing risks
- 35:21EDR detection limits
- 42:40Defenses and Microsoft’s response
- 44:23Live demo of spoofing
- 51:28Q&A
related talks
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
01h 40mDefending against PowerShell attacks - in theory, and in practice
25mInvestigating PowerShell Attacks
49mLost in Transaction: Process Doppelgänging
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
36mBeing A Better Defender By Channeling Your Worst Adversary:
38mDirty Vanity: A New Approach to Code Injection & EDR Bypass
58mRed Team Techniques for Evading, Bypassing & Disabling MS