Process Injection T1055
Tactics: Stealth, Privilege Escalation
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Events covered
31 catalog events are tagged with this technique by at least one rule.
Authoring guide
These 329 rules share fields, values, and exclusions.
Fields filtered most (158 distinct)
These fields appear most often in rule filters.
Top indicator values (2349 distinct)
These values appear most often in rule predicates.
Exclusions (3623 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 54 rules
- Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection
- APT PRIVATELOG Image Load Pattern
- ASLR Disabled Via Sysctl or Direct Syscall - Linux
- CobaltStrike Named Pipe
- CobaltStrike Named Pipe Pattern Regex
- CobaltStrike Named Pipe Patterns
- Created Files by Microsoft Sync Center
- CreateRemoteThread API and LoadLibrary
- Dllhost.EXE Execution Anomaly
- DotNet CLR DLL Loaded By Scripting Applications
- Execution Of Non-Existing File
- HackTool - CACTUSTORCH Remote Thread Creation
- HackTool - CoercedPotato Execution
- HackTool - CoercedPotato Named Pipe Creation
- HackTool - DInjector PowerShell Cradle Execution
- HackTool - EfsPotato Named Pipe Creation
- HackTool - HollowReaper Execution
- HackTool - LittleCorporal Generated Maldoc Injection
- HackTool - Potential CobaltStrike Process Injection
- Injected Browser Process Spawning Rundll32 - GuLoader Activity
- Lummac Stealer Activity - Execution Of More.com And Vbc.exe
- Malicious Named Pipe Created
- Malware Shellcode in Verclsid Target Process
- ManageEngine Endpoint Central Dctask64.EXE Potential Abuse
- Mavinject Inject DLL Into Running Process
- Microsoft Sync Center Suspicious Network Connections
- Network Connection Initiated Via Notepad.EXE
- Potential DLL Injection Or Execution Using Tracker.exe
- Potential DLL Sideloading Using Coregen.exe
- Potential Dridex Activity
- Potential Executable Run Itself As Sacrificial Process
- Potential Linux Process Code Injection Via DD Utility
- Potential Pikabot Hollowing Activity
- Potential Process Hollowing Activity
- Potential Process Injection Via Msra.EXE
- Potential Shellcode Injection
- PowerShell ShellCode
- Process Creation Using Sysnative Folder
- Rare Remote Thread Creation By Uncommon Source Image
- RedSun - Named Pipe Created
- RedSun - TieringEngineService.exe Detected as EICAR Test File
- Remote Thread Created In Shell Application
- Remote Thread Creation By Uncommon Source Image
- Remote Thread Creation In Uncommon Target Image
- Renamed Mavinject.EXE Execution
- Renamed ZOHO Dctask64 Execution
- Suspect Svchost Activity
- Suspicious Child Process Of Wermgr.EXE
- Suspicious Cross-User Process Spawn
- Suspicious Rundll32 Invoking Inline VBScript
- Suspicious Userinit Child Process
- TAIDOOR RAT DLL Load
- Uncommon Process Access Rights For Target Image
- Uncommon Svchost Command Line Parameter
Elastic 203 rules
- API via Callback from a Suspicious Stack
- API Call from a Process with a Spoofed Parent
- API Call from a Suspicious Stack
- API Call via Jump ROP Gadget
- API Call via Timer Callback Event
- API via Trusted App Runtime DLL
- Application Javascript Injection via Nodejs
- Asynchronous Procedure Call from Unusual Module
- Common Language Runtime Loaded via an Unsigned Module
- Conhost Spawned By Suspicious Parent Process
- Cross Process API Activity with Truncated Stack
- Delayed Common Language Runtime Load
- Direct Syscall from Unsigned Module
- Direct Syscall via Assembly Bytes
- DLL Injection via MavInject Utility
- DLL Loaded via a CallBack Function
- Early Remote Memory Allocation
- Egress Network Connection from Memory File Descriptor
- Evasion via Multiple Memory Section Mapping
- Evasion via Sleep API Hooking
- Execution of Memory File Descriptor via Suspicious Process
- File Creation or Modification via (Memory) File Descriptor
- Hollow Image Behavior via Native API
- Image Hollow from Unusual Stack
- Image Load via Synthetic Stack Spoofing
- Image Load via Transactional NTFS
- Internet Activity from Suspicious Unbacked Memory
- Library Loaded from a Spoofed Call Stack
- Library Loaded via a CallBack Function
- Library Loaded via a Worker Callback
- Library Loaded via Thread Fiber CallBack
- Linux Process Hooking via GDB
- Loadable Kernel Module Load via Forked Memory File Descriptor
- Managed .NET Code Execution via PowerShell
- Managed .NET Code Execution via Windows Script Interpreter
- Memory Allocation from a High Entropy Module
- Memory File Descriptor Child Process Execution
- Memory File Descriptor Execution from Suspicious Process
- Memory File Descriptor Process Execution
- Memory Protection from Read to Execute
- Memory Threat - Detected - Elastic Defend
- Memory Threat - Prevented- Elastic Defend
- Microsoft Common Language Runtime Loaded from Modified Memory
- Microsoft Common Language Runtime Loaded from Suspicious Memory
- Module Stomping from a Copied Library
- Network Activity from a Reflected Process
- Network Activity from a Stomped Module
- Network Activity from Modified Module
- Network Activity via (Memory) File Descriptor
- Network Connect API from Modified Memory
- Network Connect API from Unbacked Memory
- Network Connection via Process with Unusual Arguments
- Network Library Load via LdrLoadDLL
- Network Module Loaded from Suspicious Unbacked Memory
- NTDLL library loaded for a second time
- NTDLL Loaded from an Unusual Path
- Parallel NTDLL Loaded from Unbacked Memory
- Potential API Call via ROP Cleanup Gadget
- Potential Beacon Masking from a Stomped Module
- Potential Code Injection via Remote Thread
- Potential DLL Hollowing from a Writable Image
- Potential DLL Hollowing with Transactional NTFS
- Potential Evasion via Inline Execute Assembly
- Potential Evasion via Invalid Code Signature
- Potential Evasion with Hardware Breakpoints
- Potential Exploitation via ComDotNet Exploit
- Potential Fileless Execution Sequence
- Potential Fileless Execution via Memory File Descriptor by LoLBin
- Potential Fileless Execution via Memory File Descriptor from Interpreter
- Potential Hardware Breakpoints Evasion
- Potential Image Hollowing via Mapping
- Potential Image Load via Transactional NTFS
- Potential Injection from a LUA Script
- Potential Injection via Asynchronous Procedure Call
- Potential Injection via DotNET Debugging
- Potential Injection via Module Stomping
- Potential Injection via NSIS Installer
- Potential Injection via PyInstaller Executable
- Potential Injection via the Console Window Class
- Potential Library Load via ROP Gadgets
- Potential Loadable Kernel Module Load via Memory File Descriptor
- Potential Masquerading as Windows Error Manager
- Potential Memory File Descriptor Process Execution
- Potential Module Stomping with Network Activity
- Potential NTDLL Memory Unhooking
- Potential Operation via Direct Syscall
- Potential PowerShell HackTool Script by Function Names
- Potential Privilege Escalation via SetWindowsHook DLL Injection
- Potential Process Creation via Direct Syscall
- Potential Process Creation via ShellCode
- Potential Process Injection from Malicious Document
- Potential Process Injection via PowerShell
- Potential Remote Code Injection
- Potential Shellcode Injection by a Browser Process
- Potential Shellcode Injection via a WebShell
- Potential Shellcode Injection via CLR
- Potential Shellcode Injection via Node.js
- Potential Sudo Token Manipulation via Process Injection
- Potential Suspended Process Code Injection
- Potential Unbacked Memory Content Masking
- Privilege Escalation via GDB CAP_SYS_PTRACE
- Process Creation from a Stomped Module
- Process Creation from Backed RWX Memory
- Process Creation from Unbacked Memory via Unsigned Parent
- Process Creation via ROP Gadgets
- Process Executable Image Tampering Attempt
- Process from Archive or Removable Media via Unbacked Code
- Process Injection - Detected - Elastic Endgame
- Process Injection - Prevented - Elastic Endgame
- Process Injection by the Microsoft Build Engine
- Process Memory Write to a Non Child Process
- Process Stared via Remote Thread
- Registry or File Modification from Suspicious Memory
- Remote Memory Write to a non Child Process
- Remote Memory Write to Trusted Target Process
- Remote Process Injection via Mapping
- Remote Process Injection via Python
- Remote Process Memory Write by Low Reputation Module
- Remote Thread Context Manipulation
- Root Network Connection via GDB CAP_SYS_PTRACE
- Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory
- Self Injection via AppDomain Manager Assembly
- Shellcode Allocation from Free Memory
- Shellcode behavior from suspicious RWX provenance
- Shellcode Behavior from Unusual Memory
- Shellcode Behavior via .NET Core
- Shellcode Execution from Low Reputation Module
- Shellcode Execution via a CallBack Function
- Shellcode Execution via Python Script
- Shellcode Fluctuation via CallBack
- Shellcode from Unusual Microsoft Signed Module
- Shellcode Injection from Mounted Device
- Shellcode Injection via PowerShell
- Shellcode Injection with Parent as Provenance
- Stack Spoofing via ROP Gadget for Memory API
- Suspicious .NET Reflection via PowerShell
- Suspicious Activity from a Control Panel Applet
- Suspicious API call via a Windows Installer Module
- Suspicious API Call via Windows Script Interpreter
- Suspicious Call Stack Trailing Bytes
- Suspicious Communication App Child Process
- Suspicious Endpoint Security Parent Process
- Suspicious Executable Heap Allocation via CLR
- Suspicious Executable Memory Mapping
- Suspicious Executable Memory Permission Modification
- Suspicious File Memory Mapping via Managed .NET
- Suspicious Image Load from a Stomped Module
- Suspicious Image Load from SMB Shares
- Suspicious Image Load via LdrLoadDLL
- Suspicious Kernel32 Memory Protection
- Suspicious Managed Code Hosting Process
- Suspicious Memory Mapping from a Windows Installer
- Suspicious Memory Protection Change via VirtualProtect
- Suspicious Memory Protection Fluctuation
- Suspicious Memory Size Protection via VirtualProtect
- Suspicious NTDLL Image Load
- Suspicious NTDLL Memory Write
- Suspicious Null Terminated Call Stack
- Suspicious Okta Agent Cross Process Activity
- Suspicious Outlook Child Process
- Suspicious Parent-Child Relationship
- Suspicious Portable Executable Encoded in Powershell Script
- Suspicious Process Access via Direct System Call
- Suspicious Process Creation CallTrace
- Suspicious Process Creation via Reflection
- Suspicious Process with a Spoofed Parent
- Suspicious Remote Executable Memory Mapping
- Suspicious Remote Memory Allocation
- Suspicious Suspended Process Creation
- Suspicious System Module Image Hollowing
- Suspicious Task for Pid System Call
- Suspicious Thread Context Manipulation
- Suspicious Windows API Call from Virtual Disk or USB
- Suspicious Windows Explorer Execution
- Suspicious Windows NT API Hooking
- Suspicious Windows Script Interpreter Child Process
- Suspicious Zoom Child Process
- System Utility Execution from Unbacked Memory
- Transacted File Activity via an Unsigned DLL
- Unbacked Shellcode from Unsigned Module
- Unusual Child Process from a System Virtual Process
- Unusual Linux Network Activity
- Unusual Network Connection via RunDLL32
- Unusual Parent-Child Relationship
- Unusual Service Host Child Process - Childless Service
- Unusual Windows Network Activity
- VirtualAlloc API Call from an Unsigned DLL
- VirtualProtect API Call from Unusual Stack
- VirtualProtect API via Stack Truncation
- VirtualProtect Call via NtTestAlert
- VirtualProtect from Unusual NTDLL Offset
- VirtualProtect via Indirect Syscall
- VirtualProtect via Vectored Exception Handling
- Windows API Call via Indirect Random Syscall
- Windows API via a CallBack Function
- Windows API via Work Callback
- Windows Console Execution from Unbacked Memory
- Windows Error Manager/Reporting Masquerading
- Windows Socket Creation from Stomped Module
- Windows Socket Creation from Unbacked Memory
- Windows System Module Remote Hooking
- Windows Trojan Zloader
- WriteProcessMemory to Suspicious Memory Location
Splunk 63 rules
- AWS Bedrock Claude excessive use of tokens
- AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation
- AWS Bedrock Claude Hostile Prompt Sentiment
- AWS Bedrock Claude Possible Prompt Injection
- AWS Bedrock Claude Sensitive Data in Prompts
- AWS Bedrock Claude Unusually Large Prompts
- Cisco NVM - Non-Network Binary Making Network Connection
- Cisco NVM - Suspicious Network Connection From Process With No Args
- Cisco Secure Firewall - Communication Over Suspicious Ports
- Create Remote Thread In Shell Application
- DLLHost with no Command Line Arguments with Network
- GPUpdate with no Command Line Arguments with Network
- Known Process Injection Commands (PowerShell)
- Known Process Injection Commands (Sysmon)
- Known Process Injection Commands (Windows Event Log)
- Loading Of Dynwrapx Module
- Mavinject Execution (Sysmon)
- Mavinject Execution (Windows Event Log)
- Named Pipe Created (Sysmon)
- Notepad with no Command Line Arguments
- Potential CVE-2023-23397 (Sysmon)
- Potential CVE-2023-23397 (Windows Event Log)
- Powershell DLL_EXE Injection (PowerShell)
- Powershell Fileless Process Injection via GetProcAddress
- PowerShell PInvoke Process Injection API Chain
- Powershell Remote Thread To Known Windows Process
- Process Executed with Null Command Line (Sysmon)
- Process Executed with Null Command Line (Windows Event Log)
- Rare Remote Thread (Sysmon)
- Remote Thread Created by Uncommon Process (Sysmon)
- Remote Thread from Suspicious Folder (Sysmon)
- Rundll32 Create Remote Thread To A Process
- SearchProtocolHost with no Command Line with Network
- Suspicious Child Process for lsass.exe (Sysmon)
- Suspicious Child Process for lsass.exe (Windows Event Log)
- Suspicious DLLHost no Command Line Arguments
- Suspicious GPUpdate no Command Line Arguments
- Suspicious Parent Process for lsass.exe or services.exe (Sysmon)
- Suspicious Parent Process for lsass.exe or services.exe (Windows Event Log)
- Suspicious Parent Process for spoolsv.exe (Sysmon)
- Suspicious Parent Process for spoolsv.exe (Windows Event Log)
- Suspicious SearchProtocolHost no Command Line Arguments
- Trickbot Named Pipe
- Unexpected Network Connection from System Process (Sysmon)
- Unexpected Network Connection from System Process (Windows Event Log)
- Unusual svchost Child Process (Sysmon)
- Unusual svchost Child Process (Windows Event Log)
- Windows List ENV Variables Via SET Command From Uncommon Parent
- Windows Process Injection In Non-Service SearchIndexer
- Windows Process Injection into Commonly Abused Processes
- Windows Process Injection into Notepad
- Windows Process Injection Remote Thread
- Windows Process Injection Wermgr Child Process
- Windows Process With NamedPipe CommandLine
- Windows PUA Named Pipe
- Windows Rasautou DLL Execution
- Windows Remote Assistance Spawning Process
- Windows RMM Named Pipe
- Windows Suspicious C2 Named Pipe
- Windows Suspicious Named Pipe
- Windows Uncommon Remote Thread Creation In Browser Process
- Winhlp32 Spawning a Process
- Wscript Or Cscript Suspicious Child Process
Kusto 9 rules
- ADWS Connection from Process Injection Target
- Google SecOps - Multi-Event Correlated Alert
- McAfee ePO - Multiple threats on same host
- Powershell Empire Cmdlets Executed in Command Line
- Process Injection From Untrusted Process
- Process Injection Initiated By MMC
- Solorigate Named Pipe
- Suspicious named pipes
- TrendAI Vision One - Create Incident for Workbench Alerts