search

hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
2.97k stars 420 forks source link

Process overwriting #103

Closed MariasStory closed 2 years ago

MariasStory commented 2 years ago

Dear @hasherezade, Thank you for the cool set of tools. Please check if the process overwriting can be detected: https://www.kitploit.com/2022/05/processoverwriting-yet-another-variant.html

hasherezade commented 2 years ago

Hi! Thank you for your interest in my tools! Yes, as I mentioned int the Process Overwriting readme, this method can be detected by PE-sieve:

  • Can be detected by comparing of the module in memory with corresponding file (PE-sieve detects it) - just like every variant of Process Hollowing

It is mentioned under "Cons" of this method.