Reported by 2 outlets
Windows Process Injection Technique Bypasses EDR Monitoring Without WriteProcessMemory
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
A new Windows process injection method called console named-pipe injection places payloads inside a child console process without calling the heavily monitored VirtualAllocEx and WriteProcessMemory APIs. Published by researcher Two Seven One Three, the technique launches an interactive console child such as nslookup.exe or netsh.exe with standard input redirected through a named pipe; the parent writes payload bytes to the child’s stdin, then changes page protections and hijacks execution flow. MITRE ATT&CK tracks process injection under T1055; this variant evades EDR telemetry that relies on remote memory allocation patterns.
No CVEs or specific actors are tied to the technique, but the approach demonstrates how interprocess communication APIs can bypass endpoint defenses focused on traditional allocate-write-execute sequences. Defenders should correlate console process spawning, named pipe creation, stdin redirection, and thread execution across process boundaries rather than relying solely on memory-protection telemetry.
Timeline
-
original reporting
Windows Process Injection Technique Bypasses EDR Monitoring Without WriteProcessMemory
gbhackers.com · 15d ago · September 28th, 2026
A newly disclosed method for Windows process injection utilizes redirected console input and named pipes to transfer payload data into a child process without invoking the heavily monitored APIs VirtualAllocEx and WriteProcessMemory. This technique, called console named-pipe injection, highlights the need for endpoint defenses to correlate events across processes, memory protection, thread context, and interprocess […] The post New Windows Process Injection Technique Bypasses EDR Monitoring Without WriteProcessMemory appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Windows Process Injection Technique Evades EDR Monitoring Without WriteProcessMemory
cyberpress.org · 15d ago · September 28th, 2026
A newly documented Windows process injection technique can place and execute payloads inside a console application without calling the heavily monitored WriteProcessMemory and VirtualAllocEx APIs. The approach, dubbed console named-pipe injection, abuses redirected standard input to place attacker-controlled bytes into a child process’s memory before changing page protections and hijacking execution flow. Traditional remote process injection typically follows a highly recognizable sequence: an attacker opens a target process, allocates memory remotely with VirtualAllocEx , copies a payload using WriteProcessMemory , and starts or redirects a thread to execute the injected code. New Windows Process Injection Technique Because this allocate-write-execute pattern is widely abused, EDR platforms commonly generate high-confidence telemetry when these APIs are used across process boundaries. MITRE ATT&CK tracks the broader activity as Process Injection, technique T1055. The new method, published by researcher Two Seven One Three, replaces direct remote-memory writes with Windows interprocess communication. console program nslookup.exe (Source: zerosalarium) Instead of targeting an existing process, the injector launches an interactive console child process, such as nslookup.exe or netsh.exe , with its standard input redirected through a named pipe. The parent process retains the write end of that pipe and uses WriteFile to send payload bytes to the child’s standard-input handle.