Low Severity
Published: Oct 25, 2026
Process injection PoC evading VirtualAllocEx/WriteProcessMemory/CreateRemoteThread via STDIN and named pipes — EDR/AV evasion research (Windows, T1055).
# Tarsier
<p align="center">
<img src="/img/tarsier.jpg" alt="tarsier" width="500">
<br>
<em>A Tarsier</em>
</p>
Cute isn't he ?
#### Disclaimer
This project is published for **educational and security research purposes
only**. It is intended to be used on systems you own or for which you have
**explicit written authorization** to test.
Unauthorized access to computer systems, interference with their operation,
or tampering with data is a criminal offense in most jurisdictions.
The author does not encourage or condone any illegal or malicious use of
this code and accepts no responsibility for any damage or misuse. The
software is provided "as is", without warranty of any kind, express or
implied. You use this project at your own risk and are solely responsible
for complying with all applicable laws.
### What is this PoC about?
> TL;DR: Tarsier is a PoC of a recent Defense Evasion technique that can inject an executable into a process without using the OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread APIs.
Process injection is a well-known technique for evasion and persistence. The goal is to force a trusted Windows process to run arbitrary code ([T1055](https://attack.mitre.org/techniques/T1055/)).
The classic way to achieve this is to use Windows API calls such as `OpenProcess`, `WriteProcessMemory`, and `CreateRemoteThread`.
Nowadays, countermeasures for detecting this kind of malicious behavior are getting better and better. A common way to trigger an alert is to hook API calls — particularly the most suspicious ones — and then check the call stack for the following sequence:
`OpenProcess` -> `VirtualAllocEx` -> `WriteProcessMemory` -> `CreateRemoteThread`.
This new technique was discovered by two researchers at Orange Cyberdefense [here](https://sensepost.com/blog/2026/process-parameter-poisoning/) and later adapted by [ZeroSalarium](https://www.zerosalarium.com/2026/09/edr-evasion-process-injection-without-WriteProcessMemory.