Skip to main content

Posts

Showing posts from February, 2019

Mimikatz Process Doppleganging

This post is just about running a tool created by hasherezade  to perform process doppleganging. All credit goes to the researchers Tal Liberman   and Eugene Kogan from  enSilo and also  hasherezade I just wanted to simulate the same process doppleganging and detect with  pe-sieve , it is recommended to walk through author's blackhat presentation  Lost in transaction - Process Doppelgänging and tool creator's write up  Process Doppelgänging – a new way to impersonate a process Process doppelganing is a code injection technique ( can be a substitute to traditional process hollowing code injection technique) that leverages NTFS transacations related Windows API calls which are less used with malicious intent and hence "less known" to AV vendors, hence this code injection technique is more likely to go undetected. The Doppelgänging objective is to load and execute aribitrary code in the context of a legitimate process, none of the process hollowing API calls li