Malware, Threat Management

Details revealed for novel malware evasion

Attackers could potentially exploit a novel executable image tampering attack called "Process Ghosting" to enable protection evasion and stealthy activation of malicious code on Windows systems, The Hacker News reports. "With this technique, an attacker can write a piece of malware to disk in such a way that it's difficult to scan or delete it — and where it then executes the deleted malware as though it were a regular file on disk. This technique does not involve code injection, Process Hollowing, or Transactional NTFS (TxF)," said Gabriel Landau, a researcher at Elastic Security. According to Elastic Security, Process Ghosting also enables running of already deleted executables, unlike Process Doppelgänging and Process Herpaderping. "This means that it is possible to create a file, mark it for deletion, map it to an image section, close the file handle to complete the deletion, then create a process from the now-fileless section," Landau said. Microsoft has been notified regarding Process Ghosting last month, but it said that the issue does not conform to their servicing standards.
Jill Aitoro

Jill Aitoro is senior vice president of content strategy for CyberRisk Alliance. She has more than 20 years of experience editing and reporting on technology, business and policy. Prior to joining CRA, she worked at Sightline Media as editor of Defense News and executive editor of the Business-to-Government Group. She previously worked at Washington Business Journal and Nextgov, covering federal technology, contracting and policy, as well as CMP Media’s VARBusiness and CRN and Penton Media’s iSeries News.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.