Proof of Concept for Process Code Injection Without Using WriteProcessMemory
InjectSetConsole performs process code injection by leveraging a Windows named pipe.
Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.
InjectSetConsole.exe <executable_path>
executable_path: netsh.exe, nslookup.exe,... or other nteractive console program
Example: InjectSetConsole.exe C:\Windows\System32\netsh.exe
To use different shellcode, replace the bytes starting at offset 0x19 (hexadecimal) in the rawData array.
Alternatively, you can modify the search pattern to improve evasion.
EDR Evasion: Process Injection Without WriteProcessMemory
Youtube: https://youtu.be/DCUnbj_usPM
