HANDLE REDIRECT

Summary from the TLDR InfoSec newsletter

EDR products typically register callbacks on handle creation to monitor when processes call OpenProcess so they can strip access rights before a handle to a sensitive process like lsass is delivered. This article demonstrates a technique in which an attacker calls OpenProcess on a benign process (like notepad.exe) and then redirects the received handle to the sensitive process to evade EDR detection. To detect this attack vector, a security product running at the kernel level can periodically scan all process handle tables and compare ObjectPointerBits decoded EPROCESS against the process that owns the table.