From bb87609b9450a37418d3778dec7662dd381270f3 Mon Sep 17 00:00:00 2001
From: Zero2504 <84348823+zero2504@users.noreply.github.com>
Date: Wed, 8 Jul 2026 09:40:11 +0200
Subject: [PATCH] Add references section to README

Added a references section to the README file.
---
 README.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/README.md b/README.md
index 34dc759..eb633ce 100644
--- a/README.md
+++ b/README.md
@@ -22,12 +22,15 @@ Authors: Max Hirschberger & Ogulcan Ugur
 6. [Advantages of Detection Avoidance by this Technique](#6-advantages-of-detection-avoidance-by-this-technique)
 7. [Detection Approach](#7-detection-approach)
 8. [Conclusion](#8-conclusion)
+9. [References](#9-references)
 ---
 
 ## 1. Introduction
 
 P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure (Process Parameter Poisoning) as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.
 
+A similar concept was described by the security researcher [modexp](https://modexp.wordpress.com/category/windows/), who demonstrated that the arguments passed to the CreateProcess-API can be leveraged for this purpose [1].
+
 ---
 
 ## 2. Typical Process Injection and Involved System APIs
@@ -556,3 +559,9 @@ There are several suspicious indicators generated by this technique, that can be
  
 In summary, attackers can bypass modern security solutions through new ideas and small modifications, either by developing new techniques or by reapplying old techniques in novel ways. 
 Therefore it is important to continuously develop new detection rules and not solely rely on an existing solution.
+
+---
+
+## 9. References
+
+[1] https://web.archive.org/web/20241211190548/https://modexp.wordpress.com/2020/07/31/wpi-cmdline-envar/