TangledWinExec - PoCs and tools for investigation of Windows proces

项目说明

Tangled WinExec

This repository is for in of Windows process execution techniques.
Most of PoCs are given a name corresponding to the technique.

Projects

* __BlockingDLL :__ This toolset is for testing blocking DLL process. See README.md.

* __CloneProcess :__ This directory is for process forking and reflection. See README.md.

* __CommandLineSpoofing :__ This PoC performs Command Line Spoofing. This technique may not work for Windows 11.

* __DarkLoadLibrary :__ PoCs in this directory are for testing Dark Load Library which is released by @\_batsec\_. See README.md

* __GhostlyHollowing :__ This PoC performs Ghostly Hollowing.

* __Misc :__ This directory is for helper tools to de PoCs in this repository.

* __PhantomDllHollower :__ This PoC performs Phantom DLL Hollowing. See README.md.

* __PPIDSpoofing :__ This PoC performs PPID Spoofing.

* __ProcessDoppelgaenging :__ This PoC performs Process Doppelgänging. Due to kernel protection impro for Microsoft Defender, this technique does not work for recent Windows OS (since about 2021, maybe). So if you want to test this technique in newer en, must be stop Microsoft/Windows Defender Antivirus Service. See the issue for hasherezade's repository.

* __ProcessGhosting :__ This PoC performs Process Ghosting. Due to kernel protection, this technique does not work for newer Windows from 22H2.

* __ProcessHerpaderping :__ This PoC performs Process Herpaderping. Due to file lock issue, if you choose a fake image file smaller than you want to execute, file size shrinking will be failed and corrupt file signature for herpaderping process. To take full ad of this technique, fake image file size should be larger than you want to execute. Due to kernel protection, this technique does not work for newer Windows from 22H2.

* __ProcessHollowing :__ This PoC performs Process Hollowing. Unlike the original, the PE image is parsed into a new memory area instead of using ZwUnmap / NtUnmap.

* __ProcMemScan :__ This is a diagnostic tool to in remote process. See README.md.

* __ProtectedProcess :__ This toolset is for testing Protected Process. See README.md.

* __Reflecti :__ This toolset is for testing Reflective DLL Injection. See README.md.

* __sRDI :__ This directory is for tool to sRDI (Shellcode Reflective DLL Injection). See README.md.

* __TransactedHollowing :__ This PoC performs Transacted Hollowing.

* __WmiSpawn :__ This PoC tries to spawn process with WMI. The processes will be spawn as child processes of WmiPrvSE.exe. Supports local machine process execution and remote machine process execution. The usage can see README.md.

> __NOTE :__ Currently ProcessHollowing code does not works for Debug build. To test it, use Release build. See this issue.

Reference

Blocking DLL

* Pre 3rd Party DLLs from Injecting into your Malware

* Staying Under the Radar - Part 1 - PPID Spoofing and Blocking DLLs

* PPID Spoofing & BlockDLLs with NtCreateUserProcess

Command Line Spoofing

* Hide Artifacts: Process Argument Spoofing

* The return of the spoof part 2: Command line spoofing

Dark Load Library

* GitHub - bats3c/DarkLoadLibrary

* Bypassing Image Load Kernel Callbacks

Phantom DLL Hollowing

* Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing

* GitHub - forrest-orr/phantom-dll-hollower-poc

PPID Spoofing

* Access Token Manipulation: Parent PID Spoofing

* Parent PID Spoofing (Mitre:T1134)

* How to Detect Parent PID (PPID) Spoofing Attacks

* Parent Process ID (PPID) Spoofing

* The return of the spoof part 1: Parent process ID spoofing

Process Doppelgänging

* Lost in Transaction: Process Doppelgänging

* Process Injection: Process Doppelgänging

* Process Doppelgänging – a new way to impersonate a process

Process Ghosting

* What you need to know about Process Ghosting, a new executable image tampering attack

* Process Ghosting Attack

Process Herpaderping

* GitHub - jxy-s/herpaderping

* Process Herpaderping

* Process Herpaderping (Mitre:T1055)

Process Hollowing

* Process Injection: Process Hollowing

* Process Hollowing and Portable Executable Relocations

Ghostly Hollowing and Transacted Hollowing

* GitHub - hasherezade/transacted_hollowing

Protected Process

* Unknown Known DLLs

* Unreal Mode : Breaking Protected Processes

* The E of Protected Processes – Part 1: Pass-the-Hash Mitigations in Windows 8.1

* The E of Protected Processes Part 2: Exploit/Jailbreak Mitigations, Unkillable Processes and Protected Services

* Protected Processes Part 3 : Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs & Runtime Signers)

* Windows Exploitation Tricks: Exploiting Arbitrary Object Directory Creation for Local Ele of Pri

* Injecting Code into Windows Protected Processes using COM - Part 1

* Injecting Code into Windows Protected Processes using COM - Part 2

* Do You Really Know About LSA Protection (RunAsPPL)?

* Bypassing LSA Protection in Userland

* Debugging Protected Processes

* The End of PPLdump

* Protecting Windows protected processes

* Relevance of Security Features Introduced in Modern Windows OS

* Bypassing LSA Protection (aka Protected Process Light) without Mimikatz on Windows 10

* Debugging the undebuggable and finding a CVE in Microsoft Defender for Endpoint

* Sandboxing Antimalware Products for Fun and Profit

* GitHub - elastic/PPLGuard

* GitHub - gabriellandau/PPLFault

* PPLdump Is Dead. Long Li (Video)

* PPLdump Is Dead. Long Li (Slide)

Reflective DLL Injection

* GitHub - stephenfewer/Reflecti

sRDI

* sRDI – Shellcode Reflective DLL Injection

* GitHub - monoxgas/sRDI

* An Impro DLL Injection Technique

Acknowledgments

Thanks for your research:

* Tal Liberman ()

* Eugene Kogan ()

* hasherezade ()

* Gabriel Landau ()

* Forrest Orr (@_forrestorr)

* Stephen Fewer ()

* batsec (@\_batsec\_)

* Nick Landers ()

项目信息

开发语言：C#

Star 数：957

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PoCs and tools for investigation of Windows process execution techniques展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。