mirror of
https://github.com/jdu2600/Get-InjectedThreadEx
synced 2026-06-08 14:59:49 +00:00
John Uhlmann
18 lines
868 B
Markdown
18 lines
868 B
Markdown
|
|
|
|
# Get-InjectedThreadEx
|
|
|
|
[Get-InjectedThreadEx.exe](https://github.com/jdu2600/Get-InjectedThreadEx/releases/latest) scans all running threads looking for suspicious Win32StartAddresses.
|
|
|
|
Win32Startaddress anomalies include -
|
|
* not MEM_IMAGE
|
|
* non-MEM_IMAGE return address within the first 5 stack frames
|
|
* MEM_IMAGE and on a private (modified) page
|
|
* MEM_IMAGE and x64 dll and not a valid indirect call target
|
|
* MEM_IMAGE and unexpected Win32 dll
|
|
* MEM_IMAGE and x64 and unexpected prolog
|
|
* MEM_IMAGE and preceded by unexpected bytes
|
|
|
|
See my [BSides Canberra 2023 talk](https://github.com/jdu2600/conference_talks/blob/main/2023-09-bsidescbr-GetInjectedThreadEx.pdf) and [Elastic Security Labs blog](https://www.elastic.co/security-labs/get-injectedthreadex-detection-thread-creation-trampolines) for more details.
|
|
|