4 ms·

I'm surprised the call to WriteProcessMemory or creating suspended processes isn't being picked up, it usually gets you a lot of points on the "Detect binary as

I'm surprised the call to WriteProcessMemory or creating suspended processes isn't being picked up, it usually gets you a lot of points on the "Detect binary as malware heuristic" detector

seligman99 2y ago
I suspect this is where Windows backwards compatibility bites them a bit. I've got a very old tool [1] that uses WriteProcessMemory and CreateRemoteThread to create a thread in the command process that launched it to remotely change the directory in that process. It works to this day, despite looking exactly like what malware would do. My tool is nothing in the grand scheme, but I suspect I'm not the only one doing these sort of shenanigans, and no doubt some big important app is doing it and can't be bothered to fix itself, so MS is stuck supporting it. [1] https://github.com/seligman/ccd https://github.com/seligman/ccd
ale42 2y ago
If the Windows API provides those functions in the first point, I guess there are good reasons to use them. Of course if you're watching out for malware, WriteProcessMemory looks very suspicious, but it's not enough to conclude you're in presence of malware.
- winternewt 2y ago
  Those functions are for use by debuggers, and by default you need administrator rights to call them.
  - ale42 2y ago
    They are not only for that. The documentation says: Typically but not always, the process with address space that is being written to is being debugged. I don't really see why you'd need admin rights to do so. As far as the process being injected belongs to the same user and is not a protected process (DRM), OpenProcess will happily return a handle with PROCESS_VM_WRITE and PROCESS_VM_OPERATION rights as required by WriteProcessMemory. On the other hand, if you want to inject a system process, you definitely need admin rights.
    - winternewt 2y ago
      > OpenProcess will happily return a handle with PROCESS_VM_WRITE and PROCESS_VM_OPERATION rights Only if the process calling it has SE_DEBUG_NAME privileges, which you must set by opening your own process and then calling AdjustTokenPrivileges. But that will fail unless you have the "Debug Programs" right enabled in the security policy.
doctorpangloss 2y ago
The people who are selling those detectors are making holistic social experiences. It’s not complicated, if you want to buy secure software, don’t use Windows.

I'm surprised the call to WriteProcessMemory or creating suspended processes isn't being picked up, it usually gets you a lot of points on the "Detect binary as malware heuristic" detector

seligman99 2y ago

I suspect this is where Windows backwards compatibility bites them a bit. I've got a very old tool [1] that uses WriteProcessMemory and CreateRemoteThread to create a thread in the command process that launched it to remotely change the directory in that process. It works to this day, despite looking exactly like what malware would do. My tool is nothing in the grand scheme, but I suspect I'm not the only one doing these sort of shenanigans, and no doubt some big important app is doing it and can't be bothered to fix itself, so MS is stuck supporting it. [1] https://github.com/seligman/ccd https://github.com/seligman/ccd

ale42 2y ago

If the Windows API provides those functions in the first point, I guess there are good reasons to use them. Of course if you're watching out for malware, WriteProcessMemory looks very suspicious, but it's not enough to conclude you're in presence of malware.

winternewt 2y ago
Those functions are for use by debuggers, and by default you need administrator rights to call them.
- ale42 2y ago
  They are not only for that. The documentation says: Typically but not always, the process with address space that is being written to is being debugged. I don't really see why you'd need admin rights to do so. As far as the process being injected belongs to the same user and is not a protected process (DRM), OpenProcess will happily return a handle with PROCESS_VM_WRITE and PROCESS_VM_OPERATION rights as required by WriteProcessMemory. On the other hand, if you want to inject a system process, you definitely need admin rights.
  - winternewt 2y ago
    > OpenProcess will happily return a handle with PROCESS_VM_WRITE and PROCESS_VM_OPERATION rights Only if the process calling it has SE_DEBUG_NAME privileges, which you must set by opening your own process and then calling AdjustTokenPrivileges. But that will fail unless you have the "Debug Programs" right enabled in the security policy.

doctorpangloss 2y ago

The people who are selling those detectors are making holistic social experiences. It’s not complicated, if you want to buy secure software, don’t use Windows.