Process Doppelgänging

Exploiting Transactional NTFS to create a process from a transient file that is never committed to disk — evading file-based AV scanning and hash-based detection

Transactional NTFS (TxF)

Transactional NTFS, introduced in Windows Vista, allows file system operations to be grouped into ACID transactions. Using the Kernel Transaction Manager (KTM), you can open a transaction handle, perform file reads and writes within it, and then either commit (make changes permanent) or rollback (discard all changes).

Key TxF functions:

• CreateTransaction — creates a KTM transaction handle
• CreateFileTransactedW — opens/creates a file within a transaction
• WriteFile — writes to the transacted file (changes visible only within the transaction)
• RollbackTransaction — discards all changes (file as if never written)
• CommitTransaction — makes changes permanent (file appears on disk)

The Doppelgänging Technique

Process Doppelganging Steps:

1. CreateTransaction() ────────────────────────────── Get TxF handle

2. CreateFileTransactedW(
     "C:\Windows\System32\svchost.exe",
     GENERIC_WRITE, ..., hTxn) ─────────────────── Open svchost.exe
                                                     inside transaction

3. WriteFile(hTransactedFile, payload) ────────────── Write payload over
                                                     svchost.exe content
                                                     (only visible inside txn)

4. NtCreateSection(
     &hSection, ...,
     SEC_IMAGE, hTransactedFile) ──────────────────── Create image section
                                                     from the transacted
                                                     (modified) file

5. RollbackTransaction(hTxn) ─────────────────────── Discard file changes!
                                                     svchost.exe on disk
                                                     is UNCHANGED.
                                                     Section still holds
                                                     the payload image.

6. NtCreateProcessEx(
     &hProcess, ..., hSection) ────────────────────── Create process from
                                                     the section (payload!)
                                                     process path = svchost

7. Create thread, set entry point, resume ──────────── Process runs payload
                                                     Image path shows svchost
                                                     No payload on disk

Why It Evades File-Based Scanning

Process Herpaderping Variant

Process Herpaderping (discovered 2020) is related but different: it creates a legitimate-looking process and then replaces the backing file on disk with an innocuous file after the section is mapped. The sequence:

1. Write payload to a temp file on disk
2. Create a section (SEC_IMAGE) from the payload file — the section holds the payload image
3. Overwrite the file on disk with a decoy (benign .exe or garbage) while the section is open
4. Create a process from the section
5. Resume the process

Now: the process runs the payload, but if AV scans the file backing the process, it reads the decoy (benign) file. Windows holds the section in memory based on the original mapping — it doesn't re-read the file. The file on disk no longer matches the process memory.

Detection

# Detection approaches for Doppelganging and Herpaderping:

# 1. ETW-TI (Threat Intelligence provider):
#    NtCreateSection with SEC_IMAGE flag, followed by NtCreateProcessEx
#    without going through the normal CreateProcess path.
#    Stack walk shows non-standard call path.

# 2. Process creation with unusual lineage:
#    Sysmon Event ID 1 — svchost.exe spawned by unexpected parent
#    (not services.exe, not svchost -k)

# 3. Kernel callback (PsSetCreateProcessNotifyRoutineEx):
#    ImageFileName from callback does NOT match the in-memory PE.
#    EDR kernel component: at process creation callback, read the
#    process's image section and hash it; compare against the file
#    reported in the callback. Mismatch = doppelganging/herpaderping.

# 4. Memory forensics:
#    The process's image section is backed by a section that no longer
#    matches any on-disk file, OR the file-backed content doesn't match
#    the in-memory content. PE-sieve: read .text from process, read
#    .text from the file on disk. Mismatch detected.

# Sigma (approximate — requires kernel telemetry):
title: Process Created from Transacted File Section (Doppelganging)
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
    filter:
        ParentImage|endswith:
            - '\services.exe'
            - '\wininit.exe'
    condition: selection and not filter

Q & A