An emerging EDR evasion technique has proved significantly harder to detect when researchers combined it with additional methods for sidestepping endpoint security tools.

Flashpoint just published research on "process parameter poisoning," a recently discovered evasion technique designed to cheat endpoint detection and response (EDR) in Windows. First described by researchers Max Hirschberger and Ogulcan Ugur back in July, the technique relies on the fact that security tools and threat actors have historically leaned on a small set of Windows APIs to detect or execute process injection. These APIs include (but are not necessarily limited to) VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2(). More here