Extra Window Memory (EWM) injection is MITRE ATT&CK T1055.011. It targets Windows and falls under Stealth and Privilege Escalation. Like every Process Injection sub-technique, it runs code inside another live process.
How attackers use it
Before a graphical Windows process can create a window, it registers a window class. That registration can request up to 40 bytes of extra memory appended to each instance of the class, meant for data specific to that window. APIs exist to set and read it.
Forty bytes is small, but enough for a 32-bit pointer, and it is often used to point to a window procedure. MITRE describes an attack chain that writes code to shared sections of the process's memory, places a pointer to that code in the EWM, and then returns control to the address stored there.
The appeal is that writing to shared sections avoids highly monitored calls such as WriteProcessMemory and CreateRemoteThread. MITRE adds that more sophisticated samples may also work around data execution prevention by combining window procedures and other system functions to rewrite the payload into an executable part of the target.
How to detect it
MITRE's detection strategy looks for manipulation of EWM in a GUI process, where SetWindowLong or SetClassLong redirects a function pointer to shellcode in shared memory, followed by a trigger through a window message such as SendNotifyMessage.
Because the usual injection API calls are absent, detections that only watch those calls can miss this. Look for the window API pattern instead.
How to reduce the risk
MITRE lists Behavior Prevention on Endpoint. Some security tools can block common sequences of behavior that occur during injection. Verify yours covers GUI process tampering and is set to block.
Quick check
Why does EWM injection evade some monitoring?
It writes payloads to shared memory sections, so it does not need WriteProcessMemory or CreateRemoteThread, two heavily monitored calls.
