Loading story…
Microsoft and Elastic published technical details on Process Ghosting and related Windows executable image tampering techniques that let malware run after its backing file has been altered or deleted, bypassing antimalware scanning during a time-of-check/time-of-use gap in process creation. The technique abuses legacy process creation behavior, including use of the NtCreateProcessEx path, and is closely related to process doppelganging, process herpaderping, and process reimaging. Elastic described how an attacker can create a file, mark it delete-pending, write a payload, map it into an image section, close the handle so the file is removed, and then launch a process from the now fileless image section.
Elastic reported that a proof-of-concept showed Windows Defender failing to scan a payload because the file was already delete-pending or deleted when scanning occurred, and said it had reported the issue to Microsoft’s MSRC, which replied that it did not meet the servicing bar. Microsoft later described a detection approach in Microsoft Defender for Endpoint that identifies processes created without the GUID_ECP_CREATE_USER_PROCESS extra create parameter and checks whether the executable image section lost disk coherency and became page-file-backed via MmDoesFileHaveUserWritableReferences. According to Microsoft, combining those signals enables detection of known and previously unpublished variants and can generate alerts for ghosting, herpaderping, and doppelganging seen in the wild.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed a new Microsoft Defender for Endpoint detection method for stealthy Windows process execution techniques that abuse legacy NtCreateProcessEx behavior, including process ghosting, herpaderping, and doppelganging. The approach uses absence of the GUID_ECP_CREATE_USER_PROCESS signal plus image-section coherency checks to identify these attacks and generate alerts seen in the wild.
Gabriel Landau published a blog post describing Process Ghosting as a new Windows executable image tampering attack that runs malware from an image section after the backing file is deleted. The post also showed Windows Defender failing to scan and block a payload when the file was delete-pending or already deleted.
Microsoft responded to Elastic's MSRC report and said the issue did not meet its servicing bar. The Elastic blog dates that response to 2021-05-10.
Elastic Security Labs submitted a report about the Process Ghosting issue to the Microsoft Security Response Center. The blog states this occurred on 2021-05-06.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcemicrosoft.com
Open sourcedocs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple public research reports detailed how attackers can evade Windows security monitoring by abusing native APIs, loader behavior, and application logging. White Knight Labs and XPN documented techniques to suppress or bypass **Event Tracing for Windows (ETW)** visibility in .NET and Windows processes, while separate research showed that access-mask-based detections can be defeated with `DuplicateHandle` by first requesting only `PROCESS_DUP_HANDLE` and then cloning a more privileged handle to targets such as **LSASS** or **winlogon**. Microsoft documentation for `CreateProcessA` also appeared in the reference set because process creation remains central to many payload chains, including shellcode that ultimately launches command shells or follow-on tooling. Additional reports showed how attackers can blend execution into legitimate Windows behavior and trusted software. iPurple described **EntryPoint Hijacking**, in which a loaded DLL's entry point is overwritten so malicious code runs during normal thread creation or loader activity, reducing obvious injection signals and complicating EDR detection. NVISO separately analyzed Metasploit reverse-shell shellcode that walks the **PEB** and resolves APIs such as `LoadLibraryA`, networking functions, and `CreateProcessA`, while Hunt & Hackett showed that **ConnectWise Control/ScreenConnect** can be used for intrusion activity and that its own event logging can be disabled by patching `ScreenConnect.Core.dll`. Together, the reports underscore that defenders must validate loader integrity, monitor low-visibility handle requests and memory writes, and avoid relying on a single telemetry source such as ETW or application-generated event logs.
Aug 15, 2026
Two separate Windows-focused research writeups describe practical **evasion techniques against Microsoft Defender/EDR**. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., `Invoke-Mimikatz`) at runtime using PowerShell character encoding/concatenation (`[char]NN`), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled. A second report covers **EDRStartupHinder**, a newly released tool by researcher **TwoSevenOneT** that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and **Bindlink** redirection of a selected `System32` DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., `MsMpEng.exe`, running as **PPL**) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in `KnownDLLs` and identifying service group order via `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder` and tooling like Process Monitor/Process Explorer boot logs.
Jun 29, 2026
Windows parent process ID spoofing allows attackers to create a new process that appears to have been launched by a trusted parent such as `explorer.exe`, undermining detections based on parent-child process relationships. MITRE ATT&CK tracks the method as **T1134.004**, noting it can be used for both defense evasion and, in some cases, privilege escalation by assigning a privileged parent so the child may inherit an elevated token. A published C++ proof of concept demonstrated the technique by using `CreateProcess` with extended startup attributes to set `PROC_THREAD_ATTRIBUTE_PARENT_PROCESS`, launching `mspaint.exe` in a suspended state, injecting a payload, queueing execution with APC, and then resuming the thread so the process appeared to be a child of `explorer.exe`. The walkthrough said the sample was detected by 20 of 70 VirusTotal engines and linked the tradecraft to real-world offensive tooling and malware, including **Cobalt Strike** and **KONNI RAT**, highlighting how adversaries can disguise execution chains that would otherwise look suspicious.
Aug 15, 2026