A Deep Dive into the GetProcessHandleFromHwnd API
ID: 9db47376-3dae-514b-a03d-f42ab96df31d
STIX ID: report--9db47376-3dae-514b-a03d-f42ab96df31d
Feed Name: Project Zero
Threat Score
A technical code-archaeology report on the Windows GetProcessHandleFromHwnd API showing how historical and some current implementations could be abused to obtain powerful process handles (including against protected or sandboxed processes), describing the original hook-based design, the move to a Win32k kernel implementation, the disclosure and fix of CVE-2023-41772, and remaining mitigations/feature flags in Windows 11 24H2; includes exploitation notes and PoC references.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.