Process Parameter Poisoning: EDR Evasion via Windows Process Startup Parameters

Original text: “Process Parameter Poisoning” — Max Hirschberger & Ogulcan Ugur, SensePost / Orange Cyberdefense (6 July 2026). Code listings and figures are reproduced verbatim with attribution captions.

Executive Summary

Process Parameter Poisoning (P3) is a code injection technique that transfers shellcode into a foreign process via the startup parameters of CreateProcessW—specifically the lpCommandLine, lpEnvironment,…

https://core-jmp.org/2026/07/process-parameter-poisoning-edr-evasion-windows/