Skip to content

A malware technique that makes use of NTFS transactions to create a process that is not backed by a malicious file

License

Notifications You must be signed in to change notification settings

BlackHat-Ashura/Process_Doppelganging

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Process_Doppelganging

Process Doppelganging is a process injection technique that makes use of NTFS transaction to overwrite the contents of a file and create a section out of it and the transaction is reverted. This section is used to create a process that is not backed by any malicious binary.

Usage : "Process Doppelganging.exe" <Program to run>

About

A malware technique that makes use of NTFS transactions to create a process that is not backed by a malicious file

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages