Researchers have detailed an EDR evasion stack built around process parameter poisoning, a technique that slips malicious code into a process by tampering with the structures used during its initialization. Instead of calling the Windows APIs that endpoint detection and response tools typically flag, the method modifies process parameters directly, allowing the injected payload to run without tripping the usual alarms.
The attack works by targeting the data blocks that Windows uses to set up a new process, such as environment and command-line information. Because these structures are populated before the process fully initializes, the malicious changes can be executed while security monitoring is still incomplete. This lets the injection occur outside the visibility of EDR hooks that focus on well-known API calls.
The finding underscores a growing gap in endpoint security: detection logic that relies on API telemetry can miss attacks that abuse lower-level process internals. As EDR vendors improve their visibility into initialization routines, defenders will need to watch for anomalies in process parameters, not just suspicious API sequences. This report is based on a single source, so no independent corroboration or contrasting analysis is available yet.