{'created': '2020-01-14T17:18:32.126Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may inject malicious code into process via Extra '
                'Window Memory (EWM) in order to evade process-based defenses '
                'as well as possibly elevate privileges. EWM injection is a '
                'method of executing arbitrary code in the address space of a '
                'separate live process. \n'
                '\n'
                'Before creating a window, graphical Windows-based processes '
                'must prescribe to or register a windows class, which '
                'stipulate appearance and behavior (via windows procedures, '
                'which are functions that handle input/output of '
                'data).(Citation: Microsoft Window Classes) Registration of '
                'new windows classes can include a request for up to 40 bytes '
                'of EWM to be appended to the allocated memory of each '
                'instance of that class. This EWM is intended to store data '
                'specific to that window and has specific application '
                'programming interface (API) functions to set and get its '
                'value. (Citation: Microsoft GetWindowLong function) '
                '(Citation: Microsoft SetWindowLong function)\n'
                '\n'
                'Although small, the EWM is large enough to store a 32-bit '
                'pointer and is often used to point to a windows procedure. '
                'Malware may possibly utilize this memory location in part of '
                'an attack chain that includes writing code to shared sections '
                'of the process’s memory, placing a pointer to the code in '
                'EWM, then invoking execution by returning execution control '
                'to the address in the process’s EWM.\n'
                '\n'
                'Execution granted through EWM injection may allow access to '
                "both the target process's memory and possibly elevated "
                'privileges. Writing payloads to shared sections also avoids '
                'the use of highly monitored API calls such as '
                '<code>WriteProcessMemory</code> and '
                '<code>CreateRemoteThread</code>.(Citation: Elastic Process '
                'Injection July 2017) More sophisticated malware samples may '
                'also potentially bypass protection mechanisms such as data '
                'execution prevention (DEP) by triggering a combination of '
                'windows procedures and other system functions that will '
                'rewrite the malicious payload inside an executable portion of '
                'the target process.  (Citation: MalwareTech Power Loader Aug '
                '2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\n'
                '\n'
                'Running code in the context of another process may allow '
                "access to the process's memory, system/network resources, and "
                'possibly elevated privileges. Execution via EWM injection may '
                'also evade detection from security products since the '
                'execution is masked under a legitimate process. ',
 'external_references': [{'external_id': 'T1055.011',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1055/011'},
                         {'description': 'Microsoft. (n.d.). About Window '
                                         'Classes. Retrieved December 16, '
                                         '2017.',
                          'source_name': 'Microsoft Window Classes',
                          'url': 'https://msdn.microsoft.com/library/windows/desktop/ms633574.aspx'},
                         {'description': 'Microsoft. (n.d.). GetWindowLong '
                                         'function. Retrieved December 16, '
                                         '2017.',
                          'source_name': 'Microsoft GetWindowLong function',
                          'url': 'https://msdn.microsoft.com/library/windows/desktop/ms633584.aspx'},
                         {'description': 'Microsoft. (n.d.). SetWindowLong '
                                         'function. Retrieved December 16, '
                                         '2017.',
                          'source_name': 'Microsoft SetWindowLong function',
                          'url': 'https://msdn.microsoft.com/library/windows/desktop/ms633591.aspx'},
                         {'description': 'Hosseini, A. (2017, July 18). Ten '
                                         'Process Injection Techniques: A '
                                         'Technical Survey Of Common And '
                                         'Trending Process Injection '
                                         'Techniques. Retrieved December 7, '
                                         '2017.',
                          'source_name': 'Elastic Process Injection July 2017',
                          'url': 'https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process'},
                         {'description': 'MalwareTech. (2013, August 13). '
                                         'PowerLoader Injection – Something '
                                         'truly amazing. Retrieved December '
                                         '16, 2017.',
                          'source_name': 'MalwareTech Power Loader Aug 2013',
                          'url': 'https://www.malwaretech.com/2013/08/powerloader-injection-something-truly.html'},
                         {'description': 'Matrosov, A. (2013, March 19). Gapz '
                                         'and Redyms droppers based on Power '
                                         'Loader code. Retrieved December 16, '
                                         '2017.',
                          'source_name': 'WeLiveSecurity Gapz and Redyms Mar '
                                         '2013',
                          'url': 'https://www.welivesecurity.com/2013/03/19/gapz-and-redyms-droppers-based-on-power-loader-code/'},
                         {'description': 'Microsoft. (n.d.). SendNotifyMessage '
                                         'function. Retrieved December 16, '
                                         '2017.',
                          'source_name': 'Microsoft SendNotifyMessage function',
                          'url': 'https://msdn.microsoft.com/library/windows/desktop/ms644953.aspx'}],
 'id': 'attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'defense-evasion'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'privilege-escalation'}],
 'modified': '2025-10-24T17:48:19.059Z',
 'name': 'Extra Window Memory Injection',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.1'}