Process Doppelgänging
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every step AN1501 names is invisible to the three log sources in the brief. The TxF calls (CreateTransaction, CreateFileTransacted, RollbackTransaction) are not process, file-create or handle events at all, and none of Sysmon EID 1, 10 or 11 has a field that says a file handle or a section was transacted. Sysmon EID 11 (file_event) offers only Image, TargetFilename and CreationUtcTime, so a transacted write that is rolled back is indistinguishable at field level from any other file create — the distinguishing fact is that the file does not survive, which is the absence of a later event and not something a Sigma selection can express. […]
Covered instead by T1055.012.
What the technique is
Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process. Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. Adversaries may abuse TxF to a perform a file-less variation of Process Injection. Similar to Process Hollowing, process doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1501
Detects adversary abuse of Transactional NTFS (TxF) and undocumented process loading mechanisms (e.g., NtCreateProcessEx) to create a hollowed process from an uncommitted, maliciously tainted file image in memory, later executed via NtCreateThreadEx.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.