NEW PROCESS INJECTION CLASS: THE CONTEXT-ONLY ATTACK SURFACE

Summary from the TLDR InfoSec newsletter

Most process injection techniques typically begin by allocating memory, writing to that memory, and then executing it. However, the researchers in this post explored the possibility of process injection while only using the execution step. The researchers first achieved their goal by dropping a malicious DLL and then executing it by abusing that LoadLibraryA automatically appends “.dll” to strings that are passed to it. The researchers then took this one step further and used CreateRemoteThread with SetThreadContext and NTCreateThread to execute code in a remote process without needing to write a DLL to disk.