A new process injection technique leveraging Windows kernel callbacks has been shown to bypass detection in all major EDR solutions tested. The technique abuses legitimate Windows APIs in a sequence that avoids behavioral telemetry collection, effectively rendering the attack invisible to endpoint sensors.
The technique — internally dubbed 'GhostThread' by the research team — chains three undocumented kernel callback mechanisms to inject shellcode into a trusted process without triggering the standard ETW (Event Tracing for Windows) hooks that EDR vendors rely on for behavioral detection.
Testing was conducted against the latest versions of CrowdStrike Falcon, SentinelOne Singularity, Microsoft Defender for Endpoint, Carbon Black, and Cortex XDR. All five failed to detect the injection at the time of disclosure. Vendors were notified under a 90-day coordinated disclosure timeline.
The root cause lies in a race condition between kernel callback registration and the EDR's telemetry pipeline. By timing the injection to occur during a brief window when callbacks are being re-registered — a common occurrence during system updates — the attacker can execute arbitrary code in a high-integrity process context.
Detection signatures from all five vendors are expected within 30 days. In the interim, defenders should increase logging verbosity on process creation events, enable kernel-level audit policies, and monitor for anomalous parent-child process relationships — particularly instances of trusted system processes spawning unexpected children.
A proof-of-concept will be released 30 days after all vendors have shipped patches. The research team has also published YARA rules and Sigma detections targeting behavioral indicators that remain visible even when the primary injection chain succeeds.