ListPlanting
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
No log source in the brief records the mechanism AN0941 describes. ListPlanting writes and executes by posting window messages to a SysListView32 control (LVM_SETITEMPOSITION to place the payload, LVM_SORTITEMS to fire it as the sort callback), and Sysmon emits no event for window messages at all -- the FindWindow/EnumChildWindows and PostMessage/SendMessage half of the analytic is in none of the three feeds. Sysmon EID 8 (create_remote_thread) is dead by definition here: the LVM_SORTITEMS callback is precisely the substitute for CreateRemoteThread, which is what makes this a separate sub-technique, so a rule on EID 8 would validate clean and never fire. Sysmon EID 1 carries no ListPlanting-specific process creation -- the injector is an already-running process making API calls. […]
What the technique is
Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process. List-view controls are user interface windows used to display collections of items. Information about an application's list-view settings are stored within the process' memory in a SysListView32 control. ListPlanting (a form of message-passing "shatter attack") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items. Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other Process Injection methods. Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0941
Detects the use of message-based injection by monitoring for sequences involving FindWindow (EnumWindows or EnumChildWindows), VirtualAllocEx or related API calls, combined with suspicious PostMessage/SendMessage (e.g., LVM_SETITEMPOSITION) use to SysListView32 controls, followed by LVM_SORTITEMS invocation instead of WriteProcessMemory.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.