Bypass Record
Process Injection × Microsoft Windows Defender Antivirus
A publicly-reported instance of Process Injection bypassing Microsoft Windows Defender Antivirus, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
A C++ LSASS dumper uses MiniDumpWriteDump and XOR-encrypts the dump before writing to disk. Donut converts the executable into shellcode with AMSI/WLDP/ETW bypass and aPLib compression. A Go injector spawns notepad.exe, injects the shellcode, and terminates itself. The injected notepad.exe loads amsi.dll, dbghelp.dll, and dbgcore.dll to perform the dump undetected.
Detection & mitigation
Monitor for process injection events (Sysmon Event ID 10) where a process accesses LSASS or spawns a child process that loads unusual DLLs like amsi.dll, dbghelp.dll, and dbgcore.dll. Detect anomalous process creation chains (e.g., a non-standard parent spawning notepad.exe) and suspicious image loads (Sysmon Event ID 7) of debugging DLLs in processes that normally don't use them. Use endpoint detection to flag XOR-encrypted LSASS dump files written to disk.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.