Stealth Injectors

Stealthy injectors

Goals

Execute foreign code in a target process/kernel with minimal artifacts versus EDR/AC.

Usermode technique ladder

1. CreateRemoteThread + LoadLibrary — noisy baseline (know it to avoid)
2. NtCreateThreadEx + manual map
3. Thread hijack (suspend/context/RIP swap/resume)
4. QueueUserAPC / special user APC on alertable threads
5. Module stomping / module overloading (execute in legit module RX)
6. Transacted/ghost / dual-mapping variants
7. Process hollowing / doppelgänging / herpaderping (know detection cost)
8. SetWindowsHookEx (only if UI-thread delivery fits)
9. Instrumentation callback / VEH abuse for redirect

Manual map checklist

• Map sections with correct protections; apply relocs; resolve imports (including API sets)
• TLS callbacks decision; exception directory; cookie
• Erase PE headers optional; fix or avoid module list visibility intentionally
• Prefer RW→RX transitions; avoid long RWX

Kernel injection ladder

• APC to user thread from kernel
• Attach process + write + context
• Thread creation in target via NtCreateThreadEx from kernel
• Shared sections + user trigger

OPSEC

• Call stacks, allocation stubs, RWX, cross-process handle rights, abnormal module ranges
• Clean handles; avoid known bad patterns in public GH gists
• Test under target AC/EDR with telemetry capture

Technique deep mechanics

Thread hijack (the workhorse)

1. OpenThread(target main or worker with known alertable state)
2. SuspendThread -> GetThreadContext
3. Write shellcode stub (loadlib-style or map-call) to executable scratch
4. RIP = stub; stack aligned (0x28 shadow + 16-align per MS x64 ABI)
5. ResumeThread -> wait for completion flag -> restore original RIP/CONTEXT -> resume

• Detection: CONTEXT manipulation flagged by some EDRs via thread-start telemetry; use a legitimately alertable thread and restore RSP exactly.

Special user APC (Win10 20H1+)

• NtQueueApcThreadEx(th, …, QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC) — runs regardless of alertable state, on next thread scheduling; kernel-mode counterpart KeInitializeApc with UserApcRoutine inside ntdll's RtlUserApcTrampoline-adjacent region.
• Pair with mapping stub that frees itself; APC routine address must be valid at run time.

Module stomping detail

1. Load (or find already-loaded) large legit signed module with RX padding (common: system DLLs with >4KB slack at end of .text)
2. memcpy shellcode or tiny PE into slack; optional: use NtCreateSection dual-map of a data file onto an RX section of a signed module (module overloading proper)
3. Execute via hijacked thread; restore original bytes after done if transient

• Wins: allocation is a legit signed image; memory scan sees signed entropy; no RWX.
• Losses: MZ/PE headers of stomped region if sloppy; code-integrity scans of system DLLs catch byte drift.

Manual map CFG + exception correctness

• Register UNWIND_INFO + functions via RtlAddFunctionTable — or SEH/VEH and C++ exceptions crash inside your image on first throw.
• Control Flow Guard: indirect calls into your mapped image get terminated unless (a) SetProcessValidCallTargets adds your ranges, (b) you patch CFG bitmap directly (find via NtGetCurrentProcess->ProcessDynamicCodePolicy… actually bitmap via LdrSystemDllInit internals — brittle), or (c) your code only uses direct calls internally and exported thunks via legitimate addresses. Simplest: compile with /guard:cf- and avoid indirect calls out.
• TLS: if image has TLS callbacks, allocate TLS index via TlsAlloc, fill ThreadLocalStoragePointer, run callbacks with DLL_THREAD_ATTACH on each existing thread you care about.

Kernel-side injection mechanics

• KeStackAttachProcess(targetEp, &apcState) -> MmCopyVirtualMemory (pass your driver EPROCESS as from-proc) -> detach. Works for data + stub writes.
• APC from kernel: allocate user-mode stub in target (ZwAllocateVirtualMemory with previous-mode tricks or attach+MmCopy), KeInitializeApc(apc, thread, OriginalApc, …, UserApcRoutine=stub, UserApcContext=dllpath), KeInsertQueueApc. Choose NormalRoutine-null kernel APC for pure-kernel payloads.
• Create remote thread from kernel: PsCreateSystemThread then set Thread->CrossThreadFlags/process — brittle across builds; prefer APC or attach+hijack of existing thread via KeSuspendThread-equivalents (undocumented, pin per build — windows-internals).

Detection mapping (what catches what)

Test discipline

• Detonate under target AC with procmon+ETW capture first on a sacrificial account.
• YARA-scan your own artifacts (yara on E:\Tools) before shipping; public-gist shellcode is signatured within weeks.
• Verify on both 22H2/24H2+ builds: special-APC semantics and CFG defaults differ.

Pair with

kernel-dev, game-hacking, windows-internals, hypervisor-dev.