Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.^[1] Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.

List-view controls are user interface windows used to display collections of items.^[2] Information about an application's list-view settings are stored within the process' memory in aSysListView32 control.

ListPlanting (a form of message-passing "shatter attack") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.^[3] Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to theSysListView32 child of the victim process window (via Windows API calls such asFindWindow and/orEnumWindows) or otherProcess Injection methods.

Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitoredWriteProcessMemory function. For example, an adversary can use thePostMessage and/orSendMessage API functions to sendLVM_SETITEMPOSITION andLVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.^[4]

Finally, the payload is triggered by sending theLVM_SORTITEMS message to theSysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as theListView_SortItems callback.