Bypass Record
Process Injection × Microsoft Defender for Endpoint
A publicly-reported instance of Process Injection bypassing Microsoft Defender for Endpoint, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Process hollowing: creates a legitimate process in a suspended state, replaces its memory with encrypted shellcode (3DES), then resumes execution. Includes sandbox evasion, analysis evasion, and execution delay to avoid detection.
Detection & mitigation
Monitor for process creation in a suspended state (e.g., CREATE_SUSPENDED flag) followed by memory allocation and write operations (e.g., VirtualAllocEx, WriteProcessMemory) and subsequent thread resumption, especially from non-standard or newly written binaries. Mitigate by enforcing application control, enabling memory integrity features, and using EDR solutions that inspect process hollowing behavior.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.