https://0xgently.github.io/en/tags/execution/Recent content in Execution on 0xGentlyHugoenContent is licensed under CC BY 4.0. © 0xGentlyWed, 21 Oct 2026 00:00:00 +0000https://0xgently.github.io/en/posts/apc_%C4%B1nj/Wed, 21 Oct 2026 00:00:00 +0000https://0xgently.github.io/en/posts/apc_%C4%B1nj/<h1 id="apc-injection">Apc Injection</h1> <p>Today, there are many techniques we use to execute our payload when writing certain malware. In this post, we will focus on the APC Injection technique, which is one of the most fundamental and effective methods where we use the natural operation of the operating system to our advantage. Without wasting time on standard parts that are repeated in every injection, like memory allocation, we will focus directly on the technique.</p>https://0xgently.github.io/en/posts/thread_hijacking/Fri, 09 Oct 2026 00:00:00 +0000https://0xgently.github.io/en/posts/thread_hijacking/<h2 id="remote_thread_creation">Remote_Thread_Creation</h2> <p>In this article, I will talk about a technique in which we suspend a legitimate process, inject shellcode into its memory region, and then manipulate the RIP/EIP registers of its existing thread.</p> <p>In the cybersecurity world, APIs such as <code>CreateRemoteThread</code> are generally the preferred choice for executing code inside a target process. However, these functions are monitored very tightly by security mechanisms (AV/EDR) and blocked instantly. Thread Hijacking, on the other hand, instead of creating a brand-new and suspicious thread from scratch, aims to &ldquo;steal&rdquo; the route of an already existing legitimate thread.</p>