FLASHPOINT has independently validated a Windows EDR-evasion technique known as “process parameter poisoning”, first described by researchers Max Hirschberger and Ogulcan Ugur in July. The method hides a malicious payload in standard process-initialisation structures transferred when Windows starts a new process, avoiding APIs commonly monitored for process injection, including `VirtualAllocEx()`, `WriteProcessMemory()` and `MapViewOfFile2()`.
An attacker with existing code execution can create a “sacrificial process” and abuse its startup parameters to inject code. Earlier testing against four unspecified leading EDR products reportedly achieved code injection without alerts, despite detection, blocking and remediation controls being enabled.
Flashpoint implemented the technique in Rust and tested it against a commonly used open-source EDR platform with an XDR component. The EDR generated no alert, although XDR blocked later activity by the second-stage payload. When researchers added DLL unhooking and a policy blocking non-Microsoft DLLs, they observed neither XDR blocks nor platform alerts during execution.
Flashpoint said it has not found evidence of the technique in public malware samples, although it could be used by sophisticated threat actors or dedicated red teams. The company recommends inspecting process parameters for anomalies, monitoring for thread-execution hijacking, detecting code running from abnormal memory locations, and watching for memory-permission changes to executable. More broadly, defenders should monitor process behaviour rather than relying only on known injection-related API calls.