Detect Extra Window Memory Injection in IBM QRadar
Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior via windows procedures. Registration of new windows classes can include a request for up to 40 bytes of EWM. Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may utilize this memory location in part of an attack chain that includes writing code to shared sections of the process's memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process's EWM.
MITRE ATT&CK
- Technique
- T1055 Process Injection
- Sub-technique
- T1055.011 Extra Window Memory Injection
- Canonical reference
- https://attack.mitre.org/techniques/T1055/011/
QRadar Detection Query
SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime, LOGSOURCENAME(logsourceid) AS LogSource, sourceip AS SourceIP, username AS User, QIDNAME(qid) AS EventName, "SourceImage", "TargetImage", "GrantedAccess", CASE WHEN "GrantedAccess" = '0x1FFFFF' THEN 'Critical - PROCESS_ALL_ACCESS to explorer.exe' WHEN "GrantedAccess" = '0x001F0FFF' THEN 'High - Full process rights to explorer.exe' WHEN "GrantedAccess" = '0x0020' THEN 'Medium - PROCESS_VM_WRITE to explorer.exe' ELSE 'Medium - Suspicious access rights to explorer.exe' END AS EWMIndicator FROM events WHERE LOGSOURCETYPENAME(devicetype) = 'Microsoft Windows Security Event Log' AND QIDNAME(qid) LIKE '%Process Access%' AND "TargetImage" ILIKE '%\explorer.exe' AND "GrantedAccess" IN ('0x1FFFFF', '0x001F0FFF', '0x1F3FFF', '0x0020', '0x1F1FFF') AND NOT ("SourceImage" ILIKE '%\explorer.exe' OR "SourceImage" ILIKE '%\csrss.exe' OR "SourceImage" ILIKE '%\dwm.exe' OR "SourceImage" ILIKE '%\winlogon.exe' OR "SourceImage" ILIKE '%\ShellExperienceHost.exe' OR "SourceImage" ILIKE '%\SearchUI.exe' OR "SourceImage" ILIKE '%\taskhostw.exe' OR "SourceImage" ILIKE '%\sihost.exe') LAST 24 HOURS ORDER BY devicetime DESCQRadar AQL query correlating Sysmon process access events (EventID 10) forwarded via Windows Event Forwarding, detecting non-system processes opening explorer.exe with access masks associated with EWM injection including PROCESS_ALL_ACCESS and PROCESS_VM_WRITE flags.
Data Sources
Required Tables
False Positives & Tuning
- Security product agents (endpoint protection platforms, DLP solutions) that require high-privilege handles to explorer.exe for runtime behavior interception and policy enforcement
- Remote monitoring and management agents (Kaseya VSA, ConnectWise Automate, Datto RMM) that interact with the Windows shell process during remote session establishment or software deployment
- Windows diagnostic and crash dump utilities (WerFault.exe, ProcDump, Windows Error Reporting) that access explorer.exe memory during crash capture or performance analysis
Other platforms for T1055.011
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Shell_TrayWnd Window Handle
Expected signal: Sysmon Event ID 1: PowerShell execution with FindWindowW in command line. API call to FindWindowW with class name Shell_TrayWnd logged by ETW if user32.dll API tracing is enabled.
- Test 2GetWindowLong Extra Memory Read
Expected signal: Sysmon Event ID 1: PowerShell execution with GetWindowLongPtrW. ETW: user32.dll API calls for FindWindowW and GetWindowLongPtrW.
- Test 3Cross-Process Memory Write to Explorer
Expected signal: Sysmon Event ID 1: PowerShell execution. If actual OpenProcess with write rights is called: Sysmon Event ID 10 (ProcessAccess) from PowerShell to explorer.exe with PROCESS_VM_WRITE.
References (5)
- https://attack.mitre.org/techniques/T1055/011/
- https://www.malwaretech.com/2013/08/powerloader-injection-something-truly.html
- https://www.welivesecurity.com/2013/03/19/gapz-and-redyms-droppers-based-on-power-loader-code/
- https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- https://msdn.microsoft.com/library/windows/desktop/ms633591.aspx
Unlock Pro Content
Get the full detection package for T1055.011 including response playbook, investigation guide, and atomic red team tests.