TangledWinExec is a repository dedicated to exploring and demonstrating various techniques for manipulating Windows process execution. This project offers practical tools and proof-of-concept (PoC) implementations for red-teaming and reverse-engineering scenarios. The primary objective is to provide a resource for understanding and mitigating advanced process execution attacks by showcasing their mechanics and providing corresponding defensive measures. The repository primarily leverages C# for its implementations.
This repository offers a focused collection of PoCs, each targeting a specific process execution technique. It includes tools for DLL injection, process manipulation, and memory manipulation. Comprehensive documentation links to relevant research and articles are provided for each technique, promoting deeper understanding. The project's structure offers modularity, allowing users to easily explore individual techniques independently.
- DLL Injection: Tools for injecting malicious DLLs into running processes, bypassing security measures.
- Process Hollowing: Implementations of process hollowing techniques to hide malicious code.
- PPID Spoofing: Tools to spoof the parent process ID to evade detection and gain privilege escalation.
- WMI Process Spawning: Processes for spawning new processes using Windows Management Instrumentation (WMI).
- Process Doppleanging: Techniques to create a duplicate of a running process.
- Ghosting: PoCs demonstrating process ghosting for memory manipulation.
- Protected Process: Tools to explore and mitigate Windows Protected Process security features.
The project is actively maintained, with frequent updates and new PoCs being added. Recent commits indicate ongoing development and addressing of security mitigations. The README provides detailed explanations and links to relevant resources, facilitating its use for learning and research. Whilst some techniques may be affected by newer Windows versions, the repository continues to be expanded with new and adapted techniques.
TangledWinExec is valuable for security researchers, penetration testers, and system administrators seeking to understand and defend against advanced process execution attacks on Windows. By providing hands-on PoCs and relevant resources, it enables proactive security assessments and informed mitigation strategies. The repository facilitates a deeper understanding of attack techniques and provides insights into potential vulnerabilities. It is especially useful for those investigating techniques like DLL injection, process hollowing, and process doppelganging.