Exploring Protected Process Light and Exploits Red team technique—process injection—and how to leverage it against Protected Process Light (PPL)

Original text by Dang Duong Minh Nhat


Hello everyone, today I’m sharing another red team technique—process injection—and how to leverage it against Protected Process Light (PPL). Let’s explore it in the blog post below. #dll #injection #PPL #ProcessInjection #redteam #windows
core-jmp.org/?p=136

Ghost detects RWX memory, shellcode patterns, process hollowing and API hooks across Windows/Linux/macOS; integrates YARA and maps detections to MITRE ATT&CK. #tool #yara #processinjection https://bit.ly/48envh6

Waiting Thread Hijacking: A Stealthier Version of Thread Execution Hijacking - Check Point Research Research by: hasherezade Key Points Introduction Process injection is one of the important techniques used by attackers. We can find its variants implemented in almost every malware. It serves purpose...

My new blog for CPR: introducing Waiting Thread Hijacking - a remote process injection technique targeting waiting threads: research.checkpoint.com/2025/waiting... #ProcessInjection

Doppelganger: Cloning and Dumping LSASS to Evade Detection Technique for cloning and dumping LSASS to evade detection using RTCore64.sys, NtCreateProcessEx and MiniDumpWriteDump.

Just read this amazing article about #processinjection technique #doppelganger

This one here gives a detailed and understandable inside of this technique for #redteam and #blueteam equally.

vari-sh.github.io/posts/doppel...

Unmasking FinalDraft: The Malware Hiding in Your Outlook Drafts | The DefendOps Diaries Discover how FinalDraft malware exploits Outlook drafts and Microsoft Graph API to evade detection and pose advanced cyber threats.

Unmasking FinalDraft: The Malware Hiding in Your Outlook Drafts

thedefendopsdiaries.com/unmasking-fi...

#finaldraftmalware
#outlooksecurity
#cyberthreats
#microsoftgraphapi
#malwareevasion
#cybersecurity
#infosec
#phishing
#processinjection
#forensicevasion

TryHackMe | Cyber Security Training An online platform for learning and teaching cyber security, all through your browser.

Abusing Windows Internals - I have just completed this room! Check it out: tryhackme.com/room/abusing... #tryhackme #Windows #Evasion #ProcessInjection #RedTeam #PortableExecutable #DLLInjection #PEInjection #ProcessHollowing #abusingwindowsinternals via
@realtryhackme

A couple of blog posts for learning about Linux process injection (specifically sshd injection for credential harvesting)

blog.xpnsec.com/linux-proces...

jm33.me/sshd-injecti...

#processinjection #redteam #cybersecurity