Process Parameter Poisoning. Stealthy injection through process parameters

SensePost researchers have demonstrated a new way to inject code into another process without using the usual WriteProcessMemory or VirtualAllocEx functions that EDR solutions routinely monitor. The technique, dubbed Process Parameter Poisoning, manipulates process startup parameters (lpCommandLine, lpEnvironment, lpReserved from STARTUPINFOW), which are copied during process creation into the RTL_USER_PROCESS_PARAMETERS structure inside the PEB of the new process.

This approach lets malicious code execute in the target process without traditional injection artifacts, completely bypassing system call monitoring. In testing, the technique successfully evaded four popular EDR solutions, achieving code execution within the context of the new process.

Article: https://sensepost.com/blog/2026/process-parameter-poisoning/

Tool: https://github.com/Orange-Cyberdefense/p3-loader/