Malicious Process Environment Block Manipulation, (Fri, Jan 9th)

This diary-style technical write-up demonstrates how an attacker or malware can locate and modify a Windows process's PEB to overwrite the CommandLine buffer and hide or spoof process parameters; it provides proof-of-concept C code for both suspended-process modification and updating a running process, and discusses practical limitations (must not exceed original buffer length and EDRs may log original parameters at process creation).