What allows process migration to work?
Process migration happens because of process injection,a technique where a process can run its code in the virtual address space of another process
Specifically in meterpreter payload its
- Open current process token to set SE_DEBUG PRIVILAGE
- Virtualallocexe to allocate memory in target process
- Writeprocessmemory to write the payload in target process virtual
- Call the routine of the thread via Create remote thread
What are the main differences between Windows and Linux in process
For starters Linux doesn't use DLL,although there are more process injection that doesn't use Dll in windows(PE Injection),in linux you would uses LD_PRELOAD or ptrace
Is this migration a feature or a vulnerability?
Feature,since there are many use cases of process injection like debugging,game hacking,using themes,changing functionality of programs and anti virus stuff.
How can I defend it?
Most likely you would want to hook functions that might be used and then perform checks if you want to allow it to happen(Might break stuff), further read
Should I try to prevent process migration?
It mostly used in malwares to hide,even without using it,you can do just as much damage.So....no