Process Injection

https://learn.microsoft.com/en-us/dotnet/standard/native-interop/pinvoke



The idea of which is to inject untrusted code into the address space of a trusted process, potentially bypassing defence solutions and allowing the code to inherit the security context of the process's owner.


The high-level steps required for process injection to be successful are to:


  1. Allocate a new region of memory in the process.
  2. Copy the shellcode into that region.
  3. Execute the shellcode (typically with a thread).




There are some types of injection techniques:


  1. Classic Injection
  2. Classic Remote Injection
  3. Thread Hijacking
  4. Asynchronous Procedure Calls
  5. Early Bird
  6. Process Hallowing