13.2 Process Injection, Security Bypass, and Host Attack Tools
Key Takeaways
- Circumvent AV or EDR only when the rules of engagement allow it; tampering often fail-closes and can lose the session or page the SOC.
- Payload obfuscation hides how a file looks so signatures miss it; behavioral detection can still fire. User-controlled access bypass abuses a writable load path or DLL search order.
- Shell escape leaves a restricted shell; kiosk escape leaves a locked-down UI or browser — they are not 4.8 tailgating.
- Library injection, process injection, and process hollowing run code inside another process to hide; log tampering is 4.4 covering tracks on the host, not Domain 5.4 cleanup.
- Tool match: Mimikatz dumps credentials; Rubeus is Kerberos; Certify is AD CS; Seatbelt is situational awareness; PowerShell/ISE is living off the land; PsExec is remote execution; Evil-WinRM is a WinRM shell; LOLbins are signed OS binaries such as rundll32, msbuild, and certutil.
The rest of PT0-003 4.4 is how code runs and hides on a host you already occupy, plus the tool list CompTIA expects you to match. Attack types here: circumventing security tools, payload obfuscation, user-controlled access bypass, shell escape, kiosk escape, library injection, process hollowing and injection, and log tampering. Tools: Mimikatz, Rubeus, Certify, Seatbelt, PowerShell / PowerShell ISE, PsExec, Evil-WinRM, and LOLbins.
Circumventing security tools
Circumventing security tools means disabling, tampering with, or slipping past antivirus (AV), endpoint detection and response (EDR), application allow-listing, or a host firewall so a later 4.4 action is not blocked. Do it only if the rules of engagement (RoE) say you may. Many statements of work want you to prove that EDR would have caught the action, not to turn EDR off. Tampering often fail-closes: you kill the agent and the host loses the test session, or a watchdog reinstalls the agent and pages the SOC. Exam trap: always disable Defender first. That is a lab habit, not a 4.4 default. Trap two: treating every undetected payload as circumventing security tools. If you never touched the control, you obfuscated or you used a LOLbin — different bullets.
Payload obfuscation versus detection
Payload obfuscation changes how a payload looks so static signatures and simple allow-lists miss it: encoding, packing, string encryption, or wrapping the same behavior inside a signed script host. It is not the same as a full AV bypass. Behavioral EDR can still see LSASS access, a new service, or a hollowed process. When you pick it: the stem says the raw binary was blocked by signature but a transformed or living-off-the-land variant ran. When you do not: the control is behavioral and already firing on the API you must call. Exam trap: obfuscation as a magic invisibility cloak. Obfuscation fights detection of the file. It does not erase detection of the behavior.
User-controlled access bypass
User-controlled access bypass abuses a path or search order the user can write so a privileged process loads the tester's code. The conceptual Windows picture is DLL search-order hijacking: an elevated service looks for helper.dll in a directory the standard user can write, then loads it. Writable PATH entries, hijackable unquoted prefixes from the previous section, and world-writable bin directories on Linux are the same idea. When you pick it: a privileged consumer plus a user-writable load path. This is not a kernel exploit and not Mimikatz. Exam trap: calling every writable file a dump. Bypass is about who loads your code, not about extracting LSASS.
Shell escape and kiosk escape
Shell escape is breaking out of a restricted shell. The user was given rbash, a jailed SSH command, sudo vim, sudo less, or a menu that still drops to a subshell. CompTIA wants the identification: the restriction was the control; the escape is the 4.4 attack. Notes in the GTFOBins spirit exist so testers recognize that vi, find, awk, and python can spawn shells — you do not need a payload catalog on the exam.
Kiosk escape is the physical-and-browser cousin: a locked-down kiosk or assigned-access Windows session that still offers a print dialog, a Help window, a URL bar, a file:// handler, Task Manager, or a browser download that yields Explorer. When you pick it: the stem is a lobby kiosk, a voting terminal, or a warehouse scanner that only runs one app. Exam trap: calling kiosk escape a 4.8 tailgate. Tailgating is social engineering through a door. Kiosk escape is breaking the host UI. Trap two: calling every shell escape a kiosk escape. Restricted SSH is a shell; a browser-only terminal is a kiosk.
Library injection, process hollowing, and process injection
These three exist so code runs inside another process and blends into a name defenders already trust.
Library injection forces a process to load a library (DLL on Windows, shared object on Linux) the vendor did not intend. AppInit-style persistence, LD_PRELOAD conceptually, and a hijacked DLL are family members. The running process then executes the library's code in its own security context.
Process injection writes attacker code into a process that is already running. The exam picture is the payload executed as explorer.exe or svchost.exe after the tester opened that process.
Process hollowing starts a legitimate process in a suspended state, replaces its memory with attacker code, and resumes it. From the outside, the process name is notepad.exe or svchost.exe. From the inside, the code is the tester's. Why the exam cares: this is concealment, not a new privilege by itself. You still need a right to create or open the target process. Exam trap: calling hollowing a UAC bypass. Hollowing hides where code runs. UAC is an integrity prompt. Trap two: calling injection the same thing as credential dumping. Injection may enable a dump by running inside a trusted name, but the 4.4 dump bullet is still credential dumping with Mimikatz as the named tool.
Log tampering (host-attack, not Domain 5 cleanup)
Log tampering is attacking the host's record of what happened: clearing Windows Security or System event logs, truncating auth.log, wiping shell history, or disabling a local audit policy so later actions leave no trail. Domain 5.4 cleanup is the authorized end-of-test restoration. Keep this bullet host-attack focused: during 4.4 you are covering tracks on the box, which the exam still wants you to name. Do not treat we will restore logs in the report as the 4.4 answer, and do not publish a log-clearing recipe. Exam trap: answering 5.4 whenever logs are mentioned. If the stem is mid-engagement and the tester cleared Security.evtx to hide LSASS access, that is 4.4 log tampering.
4.4 tool matching (hard)
| Tool | 4.4 job | Typical stem cue | Not the answer for |
|---|---|---|---|
| Mimikatz | Credential dumping on Windows | LSASS, SAM, tickets extracted on a host | 4.2 relay; 4.3 hashcat cracking |
| Rubeus | Kerberos tradecraft from a foothold | TGT/TGS harvest, Kerberoast or renew from the host | BloodHound graphing (3.1/4.3 priority) |
| Certify | AD CS from a host | Certificate templates, enrollment rights | 4.2 certificate services as a network CA scan |
| Seatbelt | Situational awareness | What is interesting on this host (UAC, services, unquoted paths) | Exploitation or dumping |
| PowerShell / PowerShell ISE | Living off the land | In-memory scripts; ISE as a signed host console | Only 2.3 recon scripting |
| PsExec | Remote execution (often service / SYSTEM-style) | Copy and run on another Windows host via admin shares | Interactive WinRM shells |
| Evil-WinRM | WinRM interactive shells | TCP 5985/5986, PowerShell remoting | SSH; PsExec over SMB |
| LOLbins | Signed OS binaries abused for execution | rundll32, msbuild, certutil, regsvr32 | Unsigned custom malware as the tool |
LOLbins (living-off-the-land binaries) are the exam's favorite concealment tool class: Microsoft-signed or OS-signed binaries that already exist on the image. certutil can fetch a file. msbuild can execute inline tasks. rundll32 can load a DLL. Defenders have a hard time blocking them without breaking Windows. Exam trap: calling Mimikatz a LOLbin. Mimikatz is a dedicated credential tool, not a signed inbox binary.
Seatbelt tells you what to try on this host. Rubeus is the Kerberos cousin of Mimikatz's ticket world — listed on 4.4 even though ticket reuse is 4.3. Certify enumerates and abuses Active Directory Certificate Services from a compromised host; that is why 4.2 told you not to pick Certify for a network CA banner. PsExec is remote execution. Evil-WinRM is a WinRM shell. If the stem has port 5985 and an interactive prompt, Evil-WinRM. If the stem has admin shares and a one-shot command as SYSTEM, PsExec. PowerShell and PowerShell ISE are living-off-the-land consoles: ISE is a signed Microsoft host, which is why testers use it when script blockers ignore inbox tools.
Worked matching
j.smith is now local Admin on WS-042. Seatbelt listed AlwaysInstallElevated, an unquoted path (already used), and Defender still running. RoE forbids disabling EDR; the tester does not circumvent security tools by killing the agent. A raw drop is signature-blocked; wrapping the same behavior in msbuild is LOLbin execution plus payload obfuscation, not a Mimikatz substitute. To hide a follow-on payload, process hollowing of a trusted name is the 4.4 concealment answer. Mimikatz still dumps LSASS once the integrity level allows it. Rubeus harvests a TGT from the same session. Certify is the answer only if the stem turns to a certificate template the host can enroll. Evil-WinRM is how the tester later lands an interactive session on FILE01 over 5985; PsExec is the SMB-service-style alternative. Clearing Security.evtx after the dump is log tampering — a 4.4 host attack, documented, not a 5.4 restoration step yet.
A tester starts a legitimate Windows process suspended, replaces its memory with tester code, and resumes it so Task Manager still shows notepad.exe. Which 4.4 attack is that?
Which 4.4 tool match is exam-correct?
Rules of engagement forbid disabling endpoint detection. A raw payload is signature-blocked. The tester still needs execution on the host. Which approach matches 4.4?