Video Walks Through Process Ghosting for In-Memory Payload Execution

Summary

The video explains Process Ghosting and contrasts it with Process Doppelgänging, showing how file sections and process creation are used to execute an in-memory payload. The presenter speculates that the technique may now be detectable.

Key points

• The presenter explains Process Doppelgänging as saving a clean file state in an NTFS transaction, writing a payload, creating a section, then restoring the original file while launching from the section.
• For Process Ghosting, the presenter describes marking a temporary file for deletion, writing the payload and creating a section, then starting execution from that section as the file is removed.
• The techniques are presented as ways to execute payloads from memory and potentially evade antivirus and EDR inspection of files.
• The video walks through an open-source C++ implementation and its Windows API calls; the project is not named in the transcript.
• The presenter speculates that Process Doppelgänging may now be highly detectable after its public disclosure, while noting that he has not tested it extensively.