A novel process injection technique that effectively bypasses leading Endpoint Detection and Response (EDR) solutions by focusing solely on execution primitives, eliminating the need for memory allocation or writing operations that typically trigger security alerts.
Dubbed “CONTEXT-Only Attack Surface,” this technique was revealed on May 16, 2025, by security researchers Yehuda Smirnov, Hoshea Yarden, Hai Vaknin, and Noam Pomerantz, who demonstrated that modern security products remain blind to attacks that leverage existing in-memory data rather than introducing new malicious code.
Execution-Only Injection: A New Attack Vector
Traditional process injection techniques typically follow a predictable pattern: allocate memory in the target process, write malicious code to that memory, and execute it.
EDR solutions have consequently focused their detection capabilities on identifying these three distinct stages. The researchers asked, “What if we skip allocation and writing entirely?”
By leveraging Windows systems’ shared memory characteristics, attackers can now execute malicious code using only a thread creation primitive.
The technique takes advantage of the fact that system DLLs like ntdll.dll are loaded at consistent base addresses across all processes, allowing attackers to reuse existing data without introducing detectable changes.
This code sample demonstrates how attackers can create a remote thread that calls LoadLibraryA with a pointer to an existing string in memory, causing Windows to load a malicious DLL without ever writing to the target process’s memory.
Three Implementation Methods
The researchers identified three distinct approaches to implementing this new attack surface:
Pointer-Only DLL Injection: By creating a remote thread pointing to LoadLibraryA and supplying a pointer to an existing string in the target process, attackers can load malicious DLLs without writing any data to the target process.
CreateRemoteThread + SetThreadContext: This technique creates a suspended thread and manipulates its register context to call arbitrary functions with up to four controlled parameters, allowing operations like VirtualAlloc and WriteProcessMemory without directly invoking them from outside the process.
NtCreateThread Context Injection: By initializing a CONTEXT structure with carefully crafted register values and supplying it directly to NtCreateThread, attackers can execute code in the target process without using SetThreadContext, further reducing the attack’s visibility.
The researchers released a tool called “RedirectThread” implementing these techniques, along with support for various APC injections.
This discovery poses significant challenges for security vendors, as execution-only attacks require a fundamentally different detection approach.
While traditional EDR products correlate suspicious allocation, writing, and execution events, this new technique produces only an execution event that appears benign in isolation.
“The model silently assumes ‘remote ≠ local’,” the researchers explained. “Once an attacker coerces the victim into performing its own writes, that assumption fails.”
Without deep intra-thread taint tracking capabilities, EDR solutions struggle to establish the causal link between external triggers and resulting internal operations.
Security experts suggest that EDR vendors must enhance monitoring for rapid threat creation events and suspicious patterns of SetThreadContext calls, while developing more sophisticated techniques to correlate execution triggers across process boundaries.
This technique joins a growing list of EDR bypass methods, including process ghosting, retro-signed drivers, and dynamic-linking injection, that continue to challenge the security industry’s detection capabilities.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
