Process Parameter Poisoning

This report introduces Process Parameter Poisoning (P3), a technique that injects and executes shellcode by placing payloads into process creation parameters (CommandLine, Environment, and ShellInfo) and redirecting the new process's main thread via SetThreadContext, thereby avoiding typical EDR-detected APIs such as WriteProcessMemory and VirtualAllocEx; the paper includes a public PoC implementation, a null-byte-avoiding shellcode generator, execution methods, and suggested detection indicators.