A newly discovered evasion technique has been found to evade endpoint detection and response (EDR) tools by injecting code into process initialization structures without using traditional Windows APIs. This “process parameter poisoning” method, first described in July by researchers Max Hirschberger and Ogulcan Ugur, relies on the fact that security tools and threat actors have historically focused on a small set of Windows APIs to detect or execute process injection.
Researchers at Flashpoint recently built upon this initial discovery by combining the evasion technique with additional methods for sidestepping endpoint security tools. They found that an attacker can create a “sacrificial process” and abuse the startup parameters Windows automatically transfers into that new process, all without using memory allocation and write operations that EDR products typically monitor for process injection.
In July, Hirschberger and Ugur tested this strategy against four unspecified market-leading EDR offerings, and reported that code injection succeeded in all cases without triggering any alerts. Flashpoint’s researchers independently validated the original research by implementing the technique in Rust and testing its behavior when combined with additional evasion measures. They found that even when implemented in Rust, the base technique was able to evade detection by a commonly used open-source EDR platform.
When combined with DLL unhooking, an evasion technique that can restore Windows library functions modified by security software, process parameter poisoning became nearly undetectable. By applying a policy to block non-Microsoft DLLs, Flashpoint made it even harder for certain third-party EDR monitoring components to load. As a result, the researchers observed no blocks from the XDR component during execution and no alerts on the platform.
The implications of this discovery are significant. Process parameter poisoning highlights the ongoing cat-and-mouse game between threat actors and defenders in the world of endpoint security. While it’s currently unclear whether this technique is being used in public malware samples, Flashpoint warns that sophisticated threat actors may still employ it.
So what can defenders do to protect themselves against process parameter poisoning? According to Flashpoint, there are several detection strategies worth implementing:
* Inspect process parameters for anomalous data
* Monitor for thread execution hijacking
* Detect code executing from abnormal memory locations
* Watch for memory permissions being changed to executable
In essence, Flashpoint recommends that defenders monitor what processes actually do rather than relying solely on the Windows API calls traditionally associated with process injection. By taking a more holistic approach to endpoint security, defenders can better prepare themselves against emerging evasion techniques like process parameter poisoning.
As Paul Daubman, senior analyst at Flashpoint, notes, “There’s nothing really stopping threat actors from using it.” While this technique may not be widely used outside of dedicated red teams or sophisticated threat actors, its discovery serves as a reminder that the cybersecurity landscape is constantly evolving. Defenders must stay vigilant and adapt their strategies to keep pace with emerging threats.
Source: Dark Reading — 2026-09-23