Defensive perspective
Now that we've seen the offense's techniques in action, let's start with what tools we might be relying on as defenders that miss these in-memory techniques. Many traditional forensics tools will completely miss these techniques, as the offense is no longer leaving file artifacts on disk. That means traditional forensic tools such as The Sleuth Kit and Cellebrite will be near useless so long as the offense doesn't create file system artifacts. Similarly, tools such as OSQuery or EDR agents that just track parent-child process relationships will miss these process injection techniques, which often are not spawning new processes.
Granted, these tools may still be able to detect the injected processes based on their anomalous behavior, which is still very effective. For example, if the defenders had EDR agents such as Wazuh or OSQuery, they could potentially catch the suspicious process making network connections to the attacker's servers...
