Giters

hasherezade / process_ghosting

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Blocked by wdfilter?

Mukad3 opened this issue · comments

commented

Hi,

I think this technique is being blocked by windows defender, even when it's disabled, and I'm not sure how. CreateRemoteThreadEx fails with 0xc0000022. I've confirmed it was working on windows 10 enterprise, with no defender installed.

commented

I believe apps like sandboxie also does something to cause that fail. mabye they hook it