Doppelgänging How to circumvent s ecurity products to execute code on Windows
0Doppelgänging How to circumvent s.ecurity products to execute code on Windows.
Researchers have disclosed an attack which exploits processes in the Windows operating system to circumvent all traditional security software and perform code execution attacks.
At Black Hat Europe on Thursday, security professionals Eugene Kogan and Tal Liberman from endpoint security firm enSilo revealed research into how cybersecurity products on the market can be circumvented by exploiting how they scan for malware and interact with memory processes.
In a presentation titled, "Lost in transaction: Process Doppelgänging," the team described a play on process hollowing to circumvent security software.
Process hollowing is the creation of a process for the sole purpose of running a malicious executable inside.