admin/Orange-Cyberdefense-p3-loader
1
0
Fork 0
mirror of https://github.com/Orange-Cyberdefense/p3-loader synced 2026-07-08 17:02:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add references section to README

Browse Source 
Added a references section to the README file.
This commit is contained in:
Zero2504
2026-07-08 09:40:11 +02:00
committed by GitHub
parent c546bd5b59
commit bb87609b94
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9
View File
@@ -22,12 +22,15 @@ Authors: Max Hirschberger & Ogulcan Ugur
6. [Advantages of Detection Avoidance by this Technique](#6-advantages-of-detection-avoidance-by-this-technique) 6. [Advantages of Detection Avoidance by this Technique](#6-advantages-of-detection-avoidance-by-this-technique)
7. [Detection Approach](#7-detection-approach) 7. [Detection Approach](#7-detection-approach)
8. [Conclusion](#8-conclusion) 8. [Conclusion](#8-conclusion)
9. [References](#9-references)
--- ---
## 1. Introduction ## 1. Introduction
P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure (Process Parameter Poisoning) as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms. P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure (Process Parameter Poisoning) as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.
A similar concept was described by the security researcher [modexp](https://modexp.wordpress.com/category/windows/), who demonstrated that the arguments passed to the CreateProcess-API can be leveraged for this purpose [1].
--- ---
## 2. Typical Process Injection and Involved System APIs ## 2. Typical Process Injection and Involved System APIs
@@ -556,3 +559,9 @@ There are several suspicious indicators generated by this technique, that can be
In summary, attackers can bypass modern security solutions through new ideas and small modifications, either by developing new techniques or by reapplying old techniques in novel ways. In summary, attackers can bypass modern security solutions through new ideas and small modifications, either by developing new techniques or by reapplying old techniques in novel ways.
Therefore it is important to continuously develop new detection rules and not solely rely on an existing solution. Therefore it is important to continuously develop new detection rules and not solely rely on an existing solution.
---
## 9. References
[1] https://web.archive.org/web/20241211190548/https://modexp.wordpress.com/2020/07/31/wpi-cmdline-envar/