Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread.
But how can they do that? Because from what I know, the AV dll is not in the process import by default, and it is done at the program startup.
Is it done by a driver that is notified at each process creation, or by a userland process?
While I don't know the specific method that AV software uses (and there may not be just one way that every AV program works), there's a few ways in general to do this. Bear in mind that AV doesn't necessarily need to load DLLs into other processes at all, though.
The most direct option is the AppInit_DLLs feature which loads arbitrary specified DLLs into every process, but this is deprecated and disabled on machine with Secure Boot enabled (which is most of them, these days). For specific executables, you can also use Image File Execution Options (see https://stackoverflow.com/questions/25008706/elegant-method-to-inject-a-dll-to-processes-before-they-start), but that's not practical in most cases. There's a new method - the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDLLs registry key (see https://en.wikipedia.org/wiki/DLL_injection) - but it has some limitations (see https://stackoverflow.com/q/68574276/3909000) and doesn't seem to be well documented.
From kernel mode, the API PsSetLoadImageNotifyRoutine can be used to hook all processes at creation and run arbitrary code in the process context, including loading a library.
There are a few other possibilities, but one that must be considered is that the OS has special functionality for antivirus apps, and this functionality may enable that DLL loading (or make it unnecessary; I don't believe e.g. Windows Defender is loading a DLL into every process).
