TA0004 · PRIVILEGE ESCALATION
Extra Window Memory Injection
Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.
Detect it with
Monitor for API calls related to enumerating and manipulating EWM such as GetWindowLong and SetWindowLong . Malware associated with this technique have also used SendNotifyMessage to trigger the associated window procedure and eventual malicious injection.
Why it matters on shift
Extra Window Memory Injection is one of the concrete ways adversaries achieve privilege escalation. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After privilege escalation, the next tactic is usually Defense Evasion. Search your telemetry for the transition before closing the ticket.
Kill-chain context