KernelCallbackTable (T1574.013) is a Windows technique in the stealth and execution tactics. The adversary abuses the KernelCallbackTable of a process to hijack its execution flow and run their own payload.
How attackers use it
The KernelCallbackTable lives in the Process Environment Block (PEB). It is set up as an array of graphics functions for a GUI process once user32.dll is loaded.
MITRE describes the idea at a high level: the adversary replaces one of the original callback functions with a malicious payload. Getting there involves related behaviors such as Reflective Code Loading (T1620) or Process Injection (T1055) into another process. The adversary finds the table through the PEB, for example with a call to the Native API function NtQueryInformationProcess, duplicates the table, points a function in it (MITRE names fnCOPYDATA) at the payload using WriteProcessMemory, and updates the PEB. The tampered function runs when it is invoked, usually through a Windows message. The table may be restored afterward.
Because everything runs inside a legitimate process, this may evade security products.
How to detect it
MITRE's analytic looks for an unexpected change to the KernelCallbackTable in a process's PEB, followed by invocation of a modified callback such as fnCOPYDATA through Windows messages. The call chain to watch is NtQueryInformationProcess, then WriteProcessMemory, then abnormal GUI callback execution. It often shows up alongside anomalous behavior such as network activity or code injection from the same process.
This is an endpoint detection problem. Cross-process memory writes and unusual API sequences are what endpoint sensors are for.
How to reduce the risk
MITRE lists one mitigation: behavior prevention on endpoint. Some endpoint security products can block behaviors tied to process injection and memory tampering based on common sequences of indicators, such as specific API function calls.
Check your own environment
- Does your endpoint product alert on cross-process memory writes into GUI processes?
- Is it enabled in blocking mode on all workstations and servers, not just audit mode?
- Do you review alerts that mention injection into trusted processes such as browsers and office software?
Quick check
Where is the KernelCallbackTable found?
In the Process Environment Block (PEB) of a process, initialized once user32.dll is loaded.
