Question About smss.exe and csrss.exe

[gabriel-maxx]

hello i would like to know what it would take to make this work in smss.exe and csrss.exe ?

first i disabled Light (WinTcb) and critical process then i used StaticSyscallsInject in smss.exe and the process just died...

in csrss.exe and I did the same thing, but instead of the process dying, the cpu is 50% infinite without stopping in the csrss.exe process, and no shell in the cobalt strike...

in other words, normal migration doesn't work and neither do syscalls do you have any ideas?