Clampi's Evasive Injection Technique

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
#1

Hope CIS’s Defense+ can catch this DLL injection technique:
http://blog.threatfire.com/2009/08/clampis-evasive-injection-technique.html

#2

Nice find. I am interested to know this as well.

#3

Now let’s find someone with the source of this baddie >:-D

#4

Yep. I will try.

#5

This techique will finally call the API CreateRemoteThread
and CreateRemoteThread is based on NtCreateThreadEx
COMODO has hooked NtCreateThreadEx.

so , the techique won’t work…

#6

CFP, EQS and OA all detect it.

[attachment deleted by admin]