A newly documented evasion technique is giving attackers a way to slip malicious code past endpoint detection and response (EDR) tools by avoiding the very APIs those tools are built to watch.

The method, described as a form of process parameter poisoning, works by injecting code into a process’s initialization structures rather than relying on traditional process injection calls. Most EDR products build their detection logic around a well-known set of Windows APIs commonly abused for code injection, such as those used to allocate memory in a remote process, write to that memory, and create a remote thread. Security vendors have spent years tuning hooks, callbacks, and behavioral rules around this API surface.

By manipulating process initialization parameters directly instead of invoking those monitored APIs, the technique reportedly achieves code execution while staying outside the visibility window most EDR agents rely on. Because the approach does not trigger the API calls that defenders have trained their tools to flag, it can bypass detection logic that assumes injection will occur through a limited number of well-understood pathways.

Why It Matters

Process injection remains one of the most common techniques used by malware operators and red teams to execute code stealthily, blend into legitimate processes, and evade signature-based defenses. EDR vendors have responded by building increasingly sophisticated detection around the handful of APIs traditionally used for this purpose.

Techniques like this one highlight a persistent cat-and-mouse dynamic in endpoint security: as defenders harden detection around known abuse patterns, attackers and researchers find adjacent structures and mechanisms that achieve the same outcome while sidestepping the monitored chokepoints.

What Defenders Should Do

  • Review EDR detection logic to confirm it is not solely dependent on monitoring a fixed list of injection-related APIs
  • Incorporate behavioral and memory-based detection that can catch anomalous process initialization regardless of the API path used
  • Stay current with research on emerging evasion techniques and test detection coverage against them where feasible
  • Treat EDR as one layer of defense rather than a sole line of protection against sophisticated injection techniques

As evasion research continues to expose gaps in API-centric detection models, security teams should expect more techniques that target the underlying process structures rather than the calls historically associated with injection.