Process Injection × STRANGETRINITY EDR

STRANGETRINITY did not inject its hooking DLL into its own user-mode process, which ran without process protection

The EDR's own user-mode process (STRANGETRINITY.exe) was not injected with the hooking DLL and lacked process protection, making it a whitelisted process. Attackers used PPID spoofing to create a child process under this whitelisted process, then performed a simple CreateRemoteThread injection to run arbitrary shellcode. Because the process was whitelisted, the EDR did not inspect or block subsequent malicious actions (e.g., Mimikatz) originating from it.

Monitor for suspicious process creation where the parent process ID (PPID) is an EDR component, especially if the child process exhibits anomalous behavior like loading unsigned DLLs or making unusual API calls. Mitigation includes enabling process protection for EDR processes and applying vendor patches to ensure self-injection and integrity checks.