A newly discovered technique has been found to evade endpoint detection and response (EDR) tools by injecting malicious code into process initialization structures without using the Windows APIs typically monitored by security software. Dubbed “process parameter poisoning,” this evasion method was first described in July, but recent research from Flashpoint reveals it’s even more effective when combined with other techniques.
The technique relies on a well-known weakness in EDR tools: their reliance on monitoring specific Windows APIs to detect or execute process injection. By abusing the startup parameters that Windows automatically transfers into new processes, an attacker can create a “sacrificial process” and inject malicious code without triggering alerts from EDR products. This means that even if an EDR is configured to detect and block process injection, it may still fail to catch this type of attack.
Researchers at Flashpoint tested the technique against a commonly used open-source EDR platform with an extended detection and response (XDR) component. The results were striking: despite the XDR component blocking subsequent activity by the second-stage payload, no alerts were generated when executing the binary. When combined with DLL unhooking – an evasion technique that restores Windows library functions modified by security software – the EDR platform failed to produce any blocks or alerts at all.
The implications of this discovery are significant. If widely adopted, process parameter poisoning could provide attackers with a nearly undetectable way to inject malware into targeted systems. Flashpoint recommends defenders take a more holistic approach to monitoring processes and detect anomalous behavior rather than relying solely on the traditional Windows API calls associated with process injection. Specifically, they suggest inspecting process parameters for unusual data, monitoring thread execution hijacking, detecting code executing from abnormal memory locations, and watching for changes in memory permissions.
While Flashpoint hasn’t identified evidence of this technique being used in public malware samples to date, analysts warn that it’s only a matter of time before sophisticated threat actors begin to adopt it. As with any emerging threat, defenders should remain vigilant and adapt their security strategies accordingly. By monitoring what processes do rather than relying on traditional detection methods, organizations can stay one step ahead of attackers and prevent the devastating consequences of a successful process parameter poisoning attack.
Source: Dark Reading — 2026-09-23