English
Process Argument Spoofing: When 4688 Lies to You
A weekend PoC that starts PowerShell suspended with a harmless command line, rewrites the command line in its PEB and resumes it: Security 4688 and Procmon log Write-Host while PowerShell downloads an executable. How it works, the length-field trick, and how to catch it with context.
Read Post