Potential process injection via tainted memory section
Identifies potential process injection when the adversary creates and maps a memory section with RW protection rights followed by mapping of the same memory section in the remote process with RX protection. By definition, the mapped view in the target process mirrors the content of the local process address space. The attacker can poison the local section memory with shellcode and execute it in the context of the remote process.
- Platform: Windows
- Severity: High
- MITRE Tactic: Defense Evasion
- MITRE Techniques: T1055