How to bypass EDR and AV solutions using Process Injection in a modern Windows environment?

All answers to this question.

EDRs are getting very good at hooking documented Windows APIs like CreateRemoteThread. To bypass this, you need to use Direct Syscalls. HellsGate or Sisyphus are great because they dynamically find the syscall numbers at runtime, avoiding the hooks placed by the security software. Another effective method for 2024 is Process Herpaderping, which obscures the file on disk while it’s being executed. In a recent engagement, we used a custom wrapper that implemented Indirect Syscalls to launch our payload. This successfully evaded a top-tier EDR because the call stack appeared to originate from a legitimate system DLL rather than our malicious executable.

   Answered 2025-07-20 by Deborah Lewis

Is it still worth trying to use PowerShell for these injections, or has the "Antimalware Scan Interface" (AMSI) made PowerShell too risky for serious pentesting?

   Answered 2025-08-05 by Kevin Parker

• Kevin, PowerShell is very noisy now. While there are AMSI bypasses, the EDR usually flags the behavior of the bypass itself. I recommend switching to C# (using the D/Invoke pattern) or using C++. These languages allow for much lower-level memory manipulation and are far less scrutinized by default logging than PowerShell scripts are in a modern, hardened environment.

     Commented 2025-08-15 by Charles Harris

I’ve had success using Dll-Side Loading with legitimate signed binaries. It’s a bit more work to find a vulnerable executable, but it’s very hard for AV to stop.

   Answered 2025-08-25 by Steven King

• Side-loading is definitely a classic for a reason. If you use a trusted binary like a signed Microsoft tool, the EDR is much more likely to trust the spawned process and ignore the malicious DLL.

     Commented 2025-08-30 by Sarah Jenkins