A Thread Chaining Attack for Bypassing a DLL Injection Monitoring System*

Some malware prevention systems utilize whitelist-based access control schemes because they are more cost-efficient than traditional blacklist-based schemes and can countermeasure unknown attacks. However, whitelist-based access control schemes are vulnerable to DLL injection attacks that impersonate privileged applications. Monitoring suspicious thread creation has been proposed to solve this problem. However, this paper demonstrates that whitelist-based access control schemes are still weak to DLL injection attacks. Additionally, the process of bypassing such monitoring mechanisms is described.