Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.12
Has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.1
All 2 software entries for this technique
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN0608 · Windows
Detects adversary manipulation of Extra Window Memory (EWM) in a GUI process, where the attacker uses SetWindowLong or SetClassLong to redirect function pointers to injected shellcode stored in shared memory, then triggers execution via a window message like SendNotifyMessage.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | etw:Microsoft-Windows-Win32k | SetWindowLong, SetClassLong, NtUserMessageCall, SendNotifyMessage, PostMessage |
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetWindowClassRegex | Regex to scope suspicious or uncommon GUI class names registered by user-created processes |
| ExecutionTriggerWindowMessage | API calls like SendNotifyMessage or PostMessage that deliver execution to the shellcode location |
| SharedSectionWriteThreshold | Set byte count thresholds on suspicious memory writes to known shared sections |
| TimeWindowSetWindowLongToMessageTrigger | Define max time (e.g., <10s) between API call to set window memory and the message call to trigger it |
Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.
Tests from Atomic Red Team (MIT licence) · technique definition
1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|