Process parameter poisoning (P3) is a Windows process-injection technique that uses data supplied when a new process starts, rather than relying on some familiar memory-allocation and memory-write calls that endpoint tools often monitor. Researchers at SensePost and Flashpoint reported successful tests in limited, undisclosed product configurations—not proof that EDR is broadly defeated. In Flashpoint’s reported test, the initial injection produced no EDR alert, but an XDR component blocked later payload activity; a combined test with additional evasion measures had a different outcome.
What process parameter poisoning changes
Conventional process injection often involves opening another process, allocating memory in it, writing code, changing memory protection, and starting or redirecting a thread. SensePost researchers Max Hirschberger and Ogulcan Ugur say many endpoint detection and response (EDR) products focus on calls such as VirtualAllocEx and WriteProcessMemory, including lower-level equivalents.
As an Amazon Associate I earn from qualifying purchases.
P3 instead uses data supplied as a new process starts and accesses that data through Windows process structures, including the Process Environment Block (PEB) and RTL_USER_PROCESS_PARAMETERS. The researchers describe redirecting execution through thread-context manipulation and making data executable. Their goal is to avoid some familiar allocation and write operations—not to make the process’s behavior inherently invisible. SensePost describes P3 as “an attack technique we developed that is used to inject code in foreign processes, without triggering typical detection mechanisms.” SensePost’s technical explanation, published July 6, 2026, provides the underlying details.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the two reported tests found
SensePost’s report and Flashpoint’s later implementation are separate tests. Their results should be read in the context of the products and configurations each account describes.
#1 Best Overall
| Test | Implementation and environment | Reported result | What was not disclosed |
|---|---|---|---|
| SensePost, July 6, 2026 | The original P3 research and proof of concept; four market-leading EDR solutions. | The researchers reported successful injection without alerts in their tests, despite configuring the products to detect, block, and remediate. | The four product identities and full configuration details are not stated in SensePost’s report. |
| Flashpoint, reported September 23, 2026 | An independently implemented Rust proof of concept tested against one open-source EDR platform with an XDR component. | In the base test, the EDR platform generated no alerts, but the XDR component blocked later activity from the second-stage payload. | The platform identity and enough configuration detail to generalize the result are not stated in Dark Reading’s account. |
| Flashpoint combined test, reported September 23, 2026 | The P3 method combined with DLL unhooking and a policy blocking non-Microsoft DLLs in the same reported test setup. | Flashpoint researchers said: “Analysts observed no blocks from the XDR during execution and observed no alerts on the platform,” as quoted by Dark Reading. | The same platform and detailed configuration limits apply; the report does not establish that this outcome carries over to other EDR/XDR products or policies. |
The reports do not establish a market-wide success rate, and the product identities and complete replication details are unavailable in the cited accounts. The results are therefore evidence about these particular tests, not a general measure of EDR effectiveness.
Why the “evasion stack” matters—and what it does not prove
In the headline, “stack” refers to combining P3 with DLL unhooking and a policy change affecting non-Microsoft DLLs in Flashpoint’s reported test. It is not a new guarantee that endpoint monitoring will fail. The change in result between the base test and combined configuration illustrates why layered defenses and configuration matter: the base test’s EDR produced no alert, yet its XDR component blocked subsequent payload activity; the combined test reported no XDR blocks during execution and no platform alerts.
Avoiding a commonly watched API pair does not remove other observable behavior. Thread execution changes, suspicious startup data, executable memory, and reads of another process’s parameter structures may still provide useful signals. The reports do not show that every EDR product misses those signals, or that the technique works across operating systems; the findings described here concern Windows.
Free tools Windows power users keep installed
One-click scans. No signup required.
What defenders can monitor
Flashpoint and SensePost both point toward behavior-focused detection rather than relying only on a short list of API calls. In practice, teams can review whether endpoint telemetry and detection logic cover these behaviors:
- Unusual process parameters: Look for anomalous startup data, including data that appears inconsistent with the process. SensePost cautions that startup-parameter heuristics alone can produce false positives.
- Thread execution changes: Monitor for thread-context manipulation or execution being redirected in a way that does not fit expected process behavior.
- Abnormal executable memory: Investigate code executing from unexpected memory locations and memory regions whose permissions change to executable.
- Access to process structures: Consider suspicious reads of another process’s parameter structures, alongside the process and thread activity around them.
These are investigation signals, not standalone proof of malicious activity. The reports recommend correlating process parameters, memory permissions, and thread behavior instead of treating any one indicator—or the absence of a particular API call—as decisive.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is P3 being used in public malware?
As of September 23, 2026, Flashpoint said it had not identified evidence of P3 in public malware samples. That is a dated observation, not evidence that the technique will remain unused. Flashpoint senior analyst Paul Daubman said, “but there’s nothing really stopping the threat actors from using it.” He also described it as “similar to process parameter spoofing, which is a well-known technique yet still not often used in samples,” and said broad use outside dedicated red teams or sophisticated threat actors was not expected. Those comments and the sample observation were reported by Dark Reading on September 23, 2026.
The available reporting supports treating P3 as a technique defenders can account for—not as a confirmed widespread malware trend or a universal EDR bypass.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
