{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1055","id":"T1055","name":"Process Injection","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1055","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"b2345be1a153a88aa01b349603cafb2e48dc74a047a0695d3081482ac12e0eb8","description":"Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1055","external_id":"T1055"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1055.001","id":"T1055.001","name":"Dynamic-link Library Injection","page":"techniques/enterprise/T1055.001/"},{"key":"enterprise/T1055.002","id":"T1055.002","name":"Portable Executable Injection","page":"techniques/enterprise/T1055.002/"},{"key":"enterprise/T1055.003","id":"T1055.003","name":"Thread Execution Hijacking","page":"techniques/enterprise/T1055.003/"},{"key":"enterprise/T1055.004","id":"T1055.004","name":"Asynchronous Procedure Call","page":"techniques/enterprise/T1055.004/"},{"key":"enterprise/T1055.005","id":"T1055.005","name":"Thread Local Storage","page":"techniques/enterprise/T1055.005/"},{"key":"enterprise/T1055.008","id":"T1055.008","name":"Ptrace System Calls","page":"techniques/enterprise/T1055.008/"},{"key":"enterprise/T1055.009","id":"T1055.009","name":"Proc Memory","page":"techniques/enterprise/T1055.009/"},{"key":"enterprise/T1055.011","id":"T1055.011","name":"Extra Window Memory Injection","page":"techniques/enterprise/T1055.011/"},{"key":"enterprise/T1055.012","id":"T1055.012","name":"Process Hollowing","page":"techniques/enterprise/T1055.012/"},{"key":"enterprise/T1055.013","id":"T1055.013","name":"Process Doppelgänging","page":"techniques/enterprise/T1055.013/"},{"key":"enterprise/T1055.014","id":"T1055.014","name":"VDSO Hijacking","page":"techniques/enterprise/T1055.014/"},{"key":"enterprise/T1055.015","id":"T1055.015","name":"ListPlanting","page":"techniques/enterprise/T1055.015/"}],"telemetry":[{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0020","name":"Process Modification","page":"telemetry/DC0020/","kind":"attack_component","category":"Endpoint activity","description":"Observed modification or tampering of a running process.","collection_focus":"Use Sysmon ProcessTampering (25) for supported detections and corroborating EDR/memory evidence; it is not a record of every memory write.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","observation","sensor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0020","collector":"illustrative-lab-collector","observation":{"process_id":4200,"observation":"process_image_changed","sensor":"lab-instrumentation"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1055","id":"T1055","name":"Process Injection","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1055","technique_page":"techniques/enterprise/T1055/","page":"detections/enterprise/T1055/","status":"rule_source_available","counts":{"sigma":24,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"02d1d718-dd13-41af-989d-ea85c7fab93f","title":"Rare Remote Thread Creation By Uncommon Source Image","status":"test","level":"high","logsource":{"product":"windows","category":"create_remote_thread"},"data_path":"data/detection-rules/02d1d718-dd13-41af-989d-ea85c7fab93f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml","author":"Perez Diego (@darkquassar), oscd.community","kind":"sigma"},{"id":"66d31e5f-52d6-40a4-9615-002d3789a119","title":"Remote Thread Creation By Uncommon Source Image","status":"test","level":"medium","logsource":{"product":"windows","category":"create_remote_thread"},"data_path":"data/detection-rules/66d31e5f-52d6-40a4-9615-002d3789a119.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml","author":"Perez Diego (@darkquassar), oscd.community","kind":"sigma"},{"id":"409f8a98-4496-4aaa-818a-c931c0a8b832","title":"Created Files by Microsoft Sync Center","status":"test","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/409f8a98-4496-4aaa-818a-c931c0a8b832.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml","author":"elhoim","kind":"sigma"},{"id":"0fa66f66-e3f6-4a9c-93f8-4f2610b00171","title":"Potential DLL Sideloading Using Coregen.exe","status":"test","level":"medium","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/0fa66f66-e3f6-4a9c-93f8-4f2610b00171.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_coregen.yml","author":"frack113","kind":"sigma"},{"id":"4508a70e-97ef-4300-b62b-ff27992990ea","title":"DotNet CLR DLL Loaded By Scripting Applications","status":"test","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/4508a70e-97ef-4300-b62b-ff27992990ea.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml","author":"omkar72, oscd.community","kind":"sigma"},{"id":"e81528db-fc02-45e8-8e98-4e84aba1f10b","title":"Network Connection Initiated Via Notepad.EXE","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/e81528db-fc02-45e8-8e98-4e84aba1f10b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_notepad.yml","author":"EagleEye Team","kind":"sigma"},{"id":"9f2cc74d-78af-4eb2-bb64-9cd1d292b87b","title":"Microsoft Sync Center Suspicious Network Connections","status":"test","level":"medium","logsource":{"product":"windows","category":"network_connection"},"data_path":"data/detection-rules/9f2cc74d-78af-4eb2-bb64-9cd1d292b87b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml","author":"elhoim","kind":"sigma"},{"id":"d5601f8c-b26f-4ab0-9035-69e11a8d4ad2","title":"CobaltStrike Named Pipe","status":"test","level":"critical","logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"data_path":"data/detection-rules/d5601f8c-b26f-4ab0-9035-69e11a8d4ad2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml","author":"Florian Roth (Nextron Systems), Wojciech Lesicki","kind":"sigma"},{"id":"0e7163d4-9e19-4fa7-9be6-000c61aad77a","title":"CobaltStrike Named Pipe Pattern Regex","status":"test","level":"critical","logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"data_path":"data/detection-rules/0e7163d4-9e19-4fa7-9be6-000c61aad77a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7","title":"CobaltStrike Named Pipe Patterns","status":"test","level":"high","logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"data_path":"data/detection-rules/85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml","author":"Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)","kind":"sigma"},{"id":"4d0083b3-580b-40da-9bba-626c19fe4033","title":"HackTool - CoercedPotato Named Pipe Creation","status":"test","level":"high","logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"data_path":"data/detection-rules/4d0083b3-580b-40da-9bba-626c19fe4033.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"637f689e-b4a5-4a86-be0e-0100a0a33ba2","title":"HackTool - EfsPotato Named Pipe Creation","status":"test","level":"high","logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"data_path":"data/detection-rules/637f689e-b4a5-4a86-be0e-0100a0a33ba2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_hktl_efspotato.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"fe3ac066-98bb-432a-b1e7-a5229cb39d4a","title":"Malicious Named Pipe Created","status":"test","level":"critical","logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"data_path":"data/detection-rules/fe3ac066-98bb-432a-b1e7-a5229cb39d4a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml","author":"Florian Roth (Nextron Systems), blueteam0ps, elhoim","kind":"sigma"},{"id":"16b37b70-6fcf-4814-a092-c36bd3aafcbd","title":"PowerShell ShellCode","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/16b37b70-6fcf-4814-a092-c36bd3aafcbd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml","author":"David Ledbetter (shellcode), Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"e7888eb1-13b0-4616-bd99-4bc0c2b054b9","title":"Dllhost.EXE Execution Anomaly","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e7888eb1-13b0-4616-bd99-4bc0c2b054b9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e8d34729-86a4-4140-adfd-0a29c2106307","title":"HackTool - CoercedPotato Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e8d34729-86a4-4140-adfd-0a29c2106307.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"d78b5d61-187d-44b6-bf02-93486a80de5a","title":"HackTool - DInjector PowerShell Cradle Execution","status":"test","level":"critical","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d78b5d61-187d-44b6-bf02-93486a80de5a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_dinjector.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"744a188b-0415-4792-896f-11ddb0588dbc","title":"Potential Process Injection Via Msra.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/744a188b-0415-4792-896f-11ddb0588dbc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msra_process_injection.yml","author":"Alexander McDonald","kind":"sigma"},{"id":"1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd","title":"Suspicious Rundll32 Invoking Inline VBScript","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_inline_vbs.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"3c1b5fb0-c72f-45ba-abd1-4d4c353144ab","title":"Process Creation Using Sysnative Folder","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/3c1b5fb0-c72f-45ba-abd1-4d4c353144ab.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_sysnative.yml","author":"Max Altgelt (Nextron Systems)","kind":"sigma"},{"id":"b655a06a-31c0-477a-95c2-3726b83d649d","title":"Suspicious Userinit Child Process","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b655a06a-31c0-477a-95c2-3726b83d649d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_userinit_child.yml","author":"Florian Roth (Nextron Systems), Samir Bousseaden (idea)","kind":"sigma"},{"id":"16c37b52-b141-42a5-a3ea-bbe098444397","title":"Suspect Svchost Activity","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/16c37b52-b141-42a5-a3ea-bbe098444397.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_svchost_execution_with_no_cli_flags.yml","author":"David Burkett, @signalblur","kind":"sigma"},{"id":"f17211f1-1f24-4d0c-829f-31e28dc93cdd","title":"Uncommon Svchost Command Line Parameter","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f17211f1-1f24-4d0c-829f-31e28dc93cdd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml","author":"Liran Ravich","kind":"sigma"},{"id":"396f6630-f3ac-44e3-bfc8-1b161bc00c4e","title":"Suspicious Child Process Of Wermgr.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/396f6630-f3ac-44e3-bfc8-1b161bc00c4e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1055-1","technique_id":"T1055","title":"T1055 Process Injection","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":98,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L98","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"6d4b4a8e04b2096c7fb8143ff10cae3d574eca30878794c703c89ae33c3b13cc","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(remote_thread_creation OR cross_process_memory_write OR suspicious_process_access) AND source_process NOT_IN approved_injectors -> ALERT","log_sources":[{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"},{"title":"Memory-Protection and Exploit-Mitigation Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#12-memory-protection-and-exploit-mitigation-logs"},{"title":"System-Call Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#9-system-call-telemetry"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1055-1","technique_id":"T1055","title":"Process injection or in-memory execution — T1055 Process Injection","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#process-injection","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":68,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L68","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"5a2c303f1eb1f0f75afd6c8df080d4db100d9f1ec3d5967596b05ee650fad175","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"process-to-process access graph and event sequence.","expected_behavior":"cross-process memory and thread relationships occur among a limited set of process pairs.","deviation":"rare edge followed by an unusual write-to-execution transition.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"},{"title":"Subgraph Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#70-subgraph-anomaly"}],"log_sources":[{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"},{"title":"Memory-Protection and Exploit-Mitigation Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#12-memory-protection-and-exploit-mitigation-logs"}],"context_references":[{"title":"Truebot joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-187a-truebot.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/230707.pdf"}]}],"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Subgraph Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#70-subgraph-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}],"strategies":[{"id":"DET0508","name":"Behavioral Detection of Process Injection Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0508","stix_id":"x-mitre-detection-strategy--9833b57b-4c83-4f58-b4cf-76f041b29273","relationship_id":"relationship--9e795af2-1202-480c-88d1-5013027ede32","description":"","analytics":[{"id":"AN1399","name":"Analytic 1399","guidance":"Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.","url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1399","platforms":["Windows"],"tuning":[{"field":"AccessMask","description":"Specific access rights used during process handle acquisition, e.g., PROCESS_VM_WRITE"},{"field":"TimeWindow","description":"Time correlation window between API calls and thread creation events"},{"field":"InjectedProcessList","description":"Known high-value targets often abused for injection (e.g., lsass.exe, explorer.exe)"}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN1399","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1399","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1399","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1399","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN1399","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1399","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0021","component":"OS API Execution","name":"etw:Microsoft-Windows-Kernel-Process","channel":"API calls","platforms":["Windows"],"analytic_id":"AN1399","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1399","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN1400","name":"Analytic 1400","guidance":"Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.","url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1400","platforms":["Linux"],"tuning":[{"field":"TargetPIDThreshold","description":"Limit to sensitive or unexpected processes being targeted (e.g., sshd, init)"},{"field":"TimeWindow","description":"Correlate mmap or writev usage to process access within a short timeframe"}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"auditd:SYSCALL","channel":"ptrace, mmap, process_vm_writev","platforms":["Linux"],"analytic_id":"AN1400","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1400","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open","platforms":["Linux"],"analytic_id":"AN1400","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1400","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0020","component":"Process Modification","name":"linux:procfs","channel":"/proc/[pid]/maps, /proc/[pid]/mem","platforms":["Linux"],"analytic_id":"AN1400","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1400","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0020/"}]},{"id":"AN1401","name":"Analytic 1401","guidance":"Detects memory-based injection by monitoring `task_for_pid`, `mach_vm_write`, and dylib injection patterns through `DYLD_INSERT_LIBRARIES` or manual memory mapping.","url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1401","platforms":["macOS"],"tuning":[{"field":"TargetProcessSignature","description":"Expected signing identity or origin of process being injected"},{"field":"MachSyscallContext","description":"Observed syscall combinations (e.g., task_for_pid followed by vm_write)"}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"macos:unifiedlog","channel":"subsystem=com.apple.security, library=libsystem_kernel.dylib","platforms":["macOS"],"analytic_id":"AN1401","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1401","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0034","component":"Process Metadata","name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP","platforms":["macOS"],"analytic_id":"AN1401","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1401","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"},{"component_id":"DC0016","component":"Module Load","name":"macos:syslog","channel":"DYLD_INSERT_LIBRARIES anomalies","platforms":["macOS"],"analytic_id":"AN1401","source_url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1401","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]}]}],"telemetry_references":[{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"},{"id":"DC0020","name":"Process Modification","tag":"Process Modification","page":"telemetry/DC0020/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0040","name":"HTRAN","page":"tools/S0040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0581","name":"IronNetInjector","page":"tools/S0581/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0040","name":"HTRAN","page":"tools/S0040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0581","name":"IronNetInjector","page":"tools/S0581/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]}],"software":[{"id":"S0024","name":"Dyre","url":"https://attack.mitre.org/software/S0024","kind":"malware","description":"[Dyre](https://attack.mitre.org/software/S0024) has the ability to directly inject its code into the web browser process.(Citation: Malwarebytes Dyreza November 2015)","relationship_id":"relationship--d9c19c4a-a2e3-41f9-b508-d0d008c08993","references":[{"source_name":"Malwarebytes Dyreza November 2015","description":"hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) can inject malicious code into process created by the “Command_Create&Inject” function.(Citation: Gh0stRAT ATT March 2019)","relationship_id":"relationship--5291c077-dc09-4716-ab9a-d65318794839","references":[{"source_name":"Gh0stRAT ATT March 2019","description":"Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}]},{"id":"S0040","name":"HTRAN","url":"https://attack.mitre.org/software/S0040","kind":"tool","description":"[HTRAN](https://attack.mitre.org/software/S0040) can inject into into running processes.(Citation: NCSC Joint Report Public Tools)","relationship_id":"relationship--60a46293-ec9e-4931-8315-03b4f68c2e74","references":[{"source_name":"NCSC Joint Report Public Tools","description":"The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.","url":"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"}]},{"id":"S0044","name":"JHUHUGIT","url":"https://attack.mitre.org/software/S0044","kind":"malware","description":"[JHUHUGIT](https://attack.mitre.org/software/S0044) performs code injection injecting its own functions to browser processes.(Citation: F-Secure Sofacy 2015)(Citation: Unit 42 Sofacy Feb 2018)","relationship_id":"relationship--da44c85c-914b-41e0-aef7-68cd3c1faea1","references":[{"source_name":"F-Secure Sofacy 2015","description":"F-Secure. (2015, September 8). Sofacy Recycles Carberp and Metasploit Code. Retrieved August 3, 2016.","url":"https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/"},{"source_name":"Unit 42 Sofacy Feb 2018","description":"Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"}]},{"id":"S0084","name":"Mis-Type","url":"https://attack.mitre.org/software/S0084","kind":"malware","description":"[Mis-Type](https://attack.mitre.org/software/S0084) has been injected directly into a running process, including `explorer.exe`.(Citation: Cylance Dust Storm)","relationship_id":"relationship--d83274f8-ac2b-4416-9fae-97f569dbcef2","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) injects itself into explorer.exe.(Citation: Symantec Dragonfly)(Citation: Gigamon Berserk Bear October 2021)","relationship_id":"relationship--535e3fbe-e6d9-4608-9689-f8f1f8c1ddc9","references":[{"source_name":"Symantec Dragonfly","description":"Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Gigamon Berserk Bear October 2021","description":"Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can inject a variety of payloads into processes dynamically chosen by the adversary.(Citation: cobaltstrike manual)(Citation: Cobalt Strike Manual 4.3 November 2020)(Citation: DFIR Conti Bazar Nov 2021)","relationship_id":"relationship--5ebc97a3-54ee-4582-92ce-981f67c26f45","references":[{"source_name":"DFIR Conti Bazar Nov 2021","description":"DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"},{"source_name":"cobaltstrike manual","description":"Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0168","name":"Gazer","url":"https://attack.mitre.org/software/S0168","kind":"malware","description":"[Gazer](https://attack.mitre.org/software/S0168) injects its communication module into an Internet accessible process through which it performs C2.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017)","relationship_id":"relationship--8acca861-11fd-49bd-8dbc-0b326f5303d6","references":[{"source_name":"ESET Gazer Aug 2017","description":"ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"},{"source_name":"Securelist WhiteBear Aug 2017","description":"Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.","url":"https://securelist.com/introducing-whitebear/81638/"}]},{"id":"S0176","name":"Wingbird","url":"https://attack.mitre.org/software/S0176","kind":"malware","description":"[Wingbird](https://attack.mitre.org/software/S0176) performs multiple process injections to hijack system processes and execute malicious code.(Citation: Microsoft SIR Vol 21)","relationship_id":"relationship--e7baabf7-9300-432d-aa78-000ac099d4d3","references":[{"source_name":"Microsoft SIR Vol 21","description":"Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.","url":"http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.(Citation: Red Canary NETWIRE January 2020)","relationship_id":"relationship--529ad26d-b31e-41c0-8f19-80e2727eb739","references":[{"source_name":"Red Canary NETWIRE January 2020","description":"Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"[JPIN](https://attack.mitre.org/software/S0201) can inject content into lsass.exe to load a module.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--72810e5a-0394-4acc-8c3d-3360df2679ee","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0206","name":"Wiarp","url":"https://attack.mitre.org/software/S0206","kind":"malware","description":"[Wiarp](https://attack.mitre.org/software/S0206) creates a backdoor through which remote attackers can inject files into running processes.(Citation: Symantec Wiarp May 2012)","relationship_id":"relationship--66f859b2-4bc2-4520-afd4-8f8a7b71a50c","references":[{"source_name":"Symantec Wiarp May 2012","description":"Zhou, R. (2012, May 15). Backdoor.Wiarp. Retrieved February 22, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051606-1005-99"}]},{"id":"S0226","name":"Smoke Loader","url":"https://attack.mitre.org/software/S0226","kind":"malware","description":"[Smoke Loader](https://attack.mitre.org/software/S0226) injects into the Internet Explorer process.(Citation: Talos Smoke Loader July 2018)","relationship_id":"relationship--95ed1db5-c388-4b1b-9824-9703b248f798","references":[{"source_name":"Talos Smoke Loader July 2018","description":"Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.","url":"https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--cc470da4-82b7-4efb-aa09-f3e7402291df","references":[{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}]},{"id":"S0247","name":"NavRAT","url":"https://attack.mitre.org/software/S0247","kind":"malware","description":"[NavRAT](https://attack.mitre.org/software/S0247) copies itself into a running Internet Explorer process to evade detection.(Citation: Talos NavRAT May 2018)","relationship_id":"relationship--81bace85-005e-4edd-bb71-ca7a57bc8a07","references":[{"source_name":"Talos NavRAT May 2018","description":"Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.","url":"https://blog.talosintelligence.com/2018/05/navrat.html"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--90eb6858-e561-4ed0-855b-f9afbe3ac394","references":[{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) has used <code>Nt*</code> [Native API](https://attack.mitre.org/techniques/T1106) functions to inject code into legitimate processes such as <code>wermgr.exe</code>.(Citation: Joe Sec Trickbot)","relationship_id":"relationship--dc309013-0487-47fa-b514-71e18344a2db","references":[{"source_name":"Joe Sec Trickbot","description":"Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.","url":"https://www.joesecurity.org/blog/498839998833561473"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) can inject into known, vulnerable binaries on targeted hosts.(Citation: SentinelLabs Agent Tesla Aug 2020) ","relationship_id":"relationship--0432482e-344c-4be3-9a70-5391cf41a935","references":[{"source_name":"SentinelLabs Agent Tesla Aug 2020","description":"Walter, J. (2020, August 10). Agent Tesla | Old RAT Uses New Tricks to Stay on Top. Retrieved December 11, 2020.","url":"https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) has a command to hide itself by injecting into another process.(Citation: Fortinet Remcos Feb 2017)","relationship_id":"relationship--54e70260-cbf3-4c6b-bd30-208329cfef26","references":[{"source_name":"Fortinet Remcos Feb 2017","description":"Bacurio, F., Salvio, J. (2017, February 14). REMCOS: A New RAT In The Wild. Retrieved November 6, 2018.","url":"https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"}]},{"id":"S0347","name":"AuditCred","url":"https://attack.mitre.org/software/S0347","kind":"malware","description":"[AuditCred](https://attack.mitre.org/software/S0347) can inject code from files to other running processes.(Citation: TrendMicro Lazarus Nov 2018)","relationship_id":"relationship--4c654359-aefe-4c86-a092-44e99931d340","references":[{"source_name":"TrendMicro Lazarus Nov 2018","description":"Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) injects into a newly spawned process created from a native Windows executable.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--a24d8975-fa51-4ac1-b928-9af5b5660109","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) contains multiple modules for injecting into processes, such as <code>Invoke-PSInject</code>.(Citation: Github PowerShell Empire)","relationship_id":"relationship--85dc96ac-ec8e-4e15-ba4b-807c1a7b46cc","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has injected into running processes.(Citation: US-CERT HOPLIGHT Apr 2019)\t","relationship_id":"relationship--d0cc4ab9-e211-4824-af74-7d88699731a2","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) contains multiple modules for injecting into processes, such as <code>Invoke-PSInject</code>.(Citation: GitHub PoshC2)","relationship_id":"relationship--95fac0e8-32e3-4854-b542-5eb897d76f2e","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0380","name":"StoneDrill","url":"https://attack.mitre.org/software/S0380","kind":"malware","description":"[StoneDrill](https://attack.mitre.org/software/S0380) has relied on injecting its payload directly into the process memory of the victim's preferred browser.(Citation: Kaspersky StoneDrill 2017)","relationship_id":"relationship--7d7adc46-deab-4b32-9902-ac1beb0e95fa","references":[{"source_name":"Kaspersky StoneDrill 2017","description":"Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}]},{"id":"S0398","name":"HyperBro","url":"https://attack.mitre.org/software/S0398","kind":"malware","description":"[HyperBro](https://attack.mitre.org/software/S0398) can run shellcode it injects into a newly created process.(Citation: Unit42 Emissary Panda May 2019)","relationship_id":"relationship--1e9c15dc-2ba7-421e-8d67-6b59e0c457c7","references":[{"source_name":"Unit42 Emissary Panda May 2019","description":"Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"id":"S0436","name":"TSCookie","url":"https://attack.mitre.org/software/S0436","kind":"malware","description":"[TSCookie](https://attack.mitre.org/software/S0436) has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.(Citation: JPCert BlackTech Malware September 2019)","relationship_id":"relationship--2a7a5ee2-e949-4d25-895a-43ba0bc8cc33","references":[{"source_name":"JPCert BlackTech Malware September 2019","description":"Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.","url":"https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438)'s dispatcher can inject itself into running processes to gain higher privileges and to evade detection.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--a308d350-2b2b-486a-a778-8e80f231dc68","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has injected itself into remote processes to encrypt files using a combination of <code>VirtualAlloc</code>, <code>WriteProcessMemory</code>, and <code>CreateRemoteThread</code>.(Citation: CrowdStrike Ryuk January 2019)","relationship_id":"relationship--afdf9b0e-5539-464a-a403-202eaedb13cd","references":[{"source_name":"CrowdStrike Ryuk January 2019","description":"Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}]},{"id":"S0469","name":"ABK","url":"https://attack.mitre.org/software/S0469","kind":"malware","description":"[ABK](https://attack.mitre.org/software/S0469) has the ability to inject shellcode into svchost.exe.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--97fe312d-7a04-43f9-8076-69fe324517ce","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0470","name":"BBK","url":"https://attack.mitre.org/software/S0470","kind":"malware","description":"[BBK](https://attack.mitre.org/software/S0470) has the ability to inject shellcode into svchost.exe.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--2dcfc7b7-ead5-4996-b70d-205d4f9d59f5","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0473","name":"Avenger","url":"https://attack.mitre.org/software/S0473","kind":"malware","description":"[Avenger](https://attack.mitre.org/software/S0473) has the ability to inject shellcode into svchost.exe.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--99365890-fc6c-46ec-bf1f-66ccbe5d52e7","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can inject itself into running processes on a compromised host.(Citation: McAfee REvil October 2019)","relationship_id":"relationship--2c66270f-e6eb-4f0b-9006-9be7fcc9ba3a","references":[{"source_name":"McAfee REvil October 2019","description":"Saavedra-Morales, J, et al. (2019, October 20). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo. Retrieved August 5, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) can inject into running processes on a compromised host.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--11f33a6b-f2f5-4c35-a72a-e2197340b425","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can inject code through calling <code>VirtualAllocExNuma</code>.(Citation: Cybereason Bazar July 2020)","relationship_id":"relationship--227624a1-7dda-4691-89b3-49336aa68bfa","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) can inject its payload into iexplore.exe process.(Citation: Cyble Egregor Oct 2020)","relationship_id":"relationship--e88d0a1d-9861-4260-b030-dd80e81d179a","references":[{"source_name":"Cyble Egregor Oct 2020","description":"Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020.","url":"https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/"}]},{"id":"S0561","name":"GuLoader","url":"https://attack.mitre.org/software/S0561","kind":"malware","description":"[GuLoader](https://attack.mitre.org/software/S0561) has the ability to inject shellcode into a donor processes that is started in a suspended state. [GuLoader](https://attack.mitre.org/software/S0561) has previously used RegAsm as a donor process.(Citation: Medium Eli Salem GuLoader April 2021)","relationship_id":"relationship--30df477a-f775-4349-ba03-07a3f4293db4","references":[{"source_name":"Medium Eli Salem GuLoader April 2021","description":"Salem, E. (2021, April 19). Dancing With Shellcodes: Cracking the latest version of Guloader. Retrieved July 7, 2021.","url":"https://elis531989.medium.com/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4"}]},{"id":"S0579","name":"Waterbear","url":"https://attack.mitre.org/software/S0579","kind":"malware","description":"[Waterbear](https://attack.mitre.org/software/S0579) can inject decrypted shellcode into the LanmanServer service.(Citation: Trend Micro Waterbear December 2019)","relationship_id":"relationship--56e0b679-1c1b-4c82-9346-bde619c21117","references":[{"source_name":"Trend Micro Waterbear December 2019","description":"Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}]},{"id":"S0581","name":"IronNetInjector","url":"https://attack.mitre.org/software/S0581","kind":"tool","description":"[IronNetInjector](https://attack.mitre.org/software/S0581) can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.(Citation: Unit 42 IronNetInjector February 2021 )","relationship_id":"relationship--14d60e02-4ceb-4972-844c-412e9599144f","references":[{"source_name":"Unit 42 IronNetInjector February 2021 ","description":"Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.","url":"https://unit42.paloaltonetworks.com/ironnetinjector/"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has injected an install module into a newly created process.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--cb02fb3b-8223-476f-90be-ab50e3432d0a","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0614","name":"CostaBricks","url":"https://attack.mitre.org/software/S0614","kind":"malware","description":"[CostaBricks](https://attack.mitre.org/software/S0614) can inject a payload into the memory of a compromised host.(Citation: BlackBerry CostaRicto November 2020)","relationship_id":"relationship--a08454ac-6680-4ea1-ab2a-f272f562fc25","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}]},{"id":"S0633","name":"Sliver","url":"https://attack.mitre.org/software/S0633","kind":"tool","description":"[Sliver](https://attack.mitre.org/software/S0633) includes multiple methods to perform process injection to migrate the framework into other, potentially privileged processes on the victim machine.(Citation: Microsoft Sliver 2022)(Citation: Cybereason Sliver Undated)(Citation: Bishop Fox Sliver Framework August 2019)(Citation: GitHub Sliver C2)","relationship_id":"relationship--223a75cd-eb8f-4477-b4c3-e2a4e651d875","references":[{"source_name":"GitHub Sliver C2","description":"BishopFox. (n.d.). Sliver. Retrieved September 15, 2021.","url":"https://github.com/BishopFox/sliver/"},{"source_name":"Cybereason Sliver Undated","description":"Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.","url":"https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors"},{"source_name":"Bishop Fox Sliver Framework August 2019","description":"Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.","url":"https://labs.bishopfox.com/tech-blog/sliver"},{"source_name":"Microsoft Sliver 2022","description":"Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.(Citation: Trend Micro Qakbot May 2020)(Citation: Kroll Qakbot June 2020)(Citation: Trend Micro Qakbot December 2020)(Citation: Kaspersky QakBot September 2021)(Citation: Trend Micro Black Basta October 2022)","relationship_id":"relationship--8235c444-415e-49ee-8ed9-10c24075be1f","references":[{"source_name":"Trend Micro Black Basta October 2022","description":"Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"},{"source_name":"Trend Micro Qakbot May 2020","description":"Mendoza, E. et al. (2020, May 25). Qakbot Resurges, Spreads through VBS Files. Retrieved September 27, 2021.","url":"https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"},{"source_name":"Kroll Qakbot June 2020","description":"Sette, N. et al. (2020, June 4). Qakbot Malware Now Exfiltrating Emails for Sophisticated Thread Hijacking Attacks. Retrieved September 27, 2021.","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Trend Micro Qakbot December 2020","description":"Trend Micro. (2020, December 17). QAKBOT: A decade-old malware still with new tricks. Retrieved November 17, 2024.","url":"https://success.trendmicro.com/en-US/solution/KA-0011282"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) can inject into the `svchost.exe` process for execution.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--666f1286-c25b-49ef-9d86-42a00ea69ab1","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0664","name":"Pandora","url":"https://attack.mitre.org/software/S0664","kind":"malware","description":"[Pandora](https://attack.mitre.org/software/S0664) can start and inject code into a new `svchost` process.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--dbcbedb9-5527-4ab9-97e7-1ed65571aee9","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) has the ability to inject malicious DLLs into a specific process for privilege escalation.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--b27650da-9a26-4bd3-9e9e-2559a0b6dc86","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) can migrate the loader into another process.(Citation: BiZone Lizar May 2021)","relationship_id":"relationship--07c87a67-32d0-4b86-9345-aad1a0241340","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can inject shellcode directly into Excel.exe or a specific process.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--5bf6d81e-634d-4035-a895-87d2d31341ce","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0695","name":"Donut","url":"https://attack.mitre.org/software/S0695","kind":"tool","description":"[Donut](https://attack.mitre.org/software/S0695) includes a subproject <code>DonutTest</code> to inject shellcode into a target process.(Citation: Donut Github)\t","relationship_id":"relationship--2c6c5572-9b89-40cd-8faa-6317945cf939","references":[{"source_name":"Donut Github","description":"TheWover. (2019, May 9). donut. Retrieved March 25, 2022.","url":"https://github.com/TheWover/donut"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) can inject code into multiple processes on infected endpoints.(Citation: Cybereason Bumblebee August 2022)","relationship_id":"relationship--836575fd-ffa1-4531-8c16-c875b7f0c177","references":[{"source_name":"Cybereason Bumblebee August 2022","description":"Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"}]},{"id":"S1050","name":"PcShare","url":"https://attack.mitre.org/software/S1050","kind":"tool","description":"The [PcShare](https://attack.mitre.org/software/S1050) payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--de8cda8f-cb21-4cd9-9ce8-a2f100f723a6","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can inject the loader file, Speech02.db, into a process.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--ed7582ee-c131-4525-8e69-26e9e5646328","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.(Citation: MalwareBytes WoodyRAT Aug 2022) ","relationship_id":"relationship--90e6cb2a-55c4-4533-bbdc-b8eed2132344","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1074","name":"ANDROMEDA","url":"https://attack.mitre.org/software/S1074","kind":"malware","description":"[ANDROMEDA](https://attack.mitre.org/software/S1074) can inject into the `wuauclt.exe` process to perform C2 actions.(Citation: Mandiant Suspected Turla Campaign February 2023)","relationship_id":"relationship--3bffbeb5-27d2-4fc3-b28b-b9f686572009","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","description":"Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021)","relationship_id":"relationship--17ec5db7-d1cd-4057-9d95-a6da56b06825","references":[{"source_name":"Gigamon BADHATCH Jul 2019","description":"Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.","url":"https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"},{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"[Ninja](https://attack.mitre.org/software/S1100) has the ability to inject an agent module into a new process and arbitrary shellcode into running processes.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--967ab393-8181-4a66-a406-39459b4a1ac7","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) includes a binary labeled `authd` that can inject a library into a running process and then hook an existing function within that process with a new function from that library.(Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--4293a182-e45b-4043-a5e7-d0ef8ae3a863","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122)'s binary is injected into memory via `WriteProcessMemory`.(Citation: Segurança Informática URSA Sophisticated Loader 2020)(Citation: SCILabs Malteiro 2021)","relationship_id":"relationship--722ffa83-29e2-48bb-a7c1-1cb52fb4aa18","references":[{"source_name":"Segurança Informática URSA Sophisticated Loader 2020","description":"Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.","url":"https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/"},{"source_name":"SCILabs Malteiro 2021","description":"SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) compromises the `.text` section of a legitimate system DLL in `%windir%` to hold the contents of retrieved plug-ins.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--15ccaabe-9b15-4d30-8931-d86d9af9f911","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1181","name":"BlackByte 2.0 Ransomware","url":"https://attack.mitre.org/software/S1181","kind":"malware","description":"[BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) injects into a newly-created `svchost.exe` process prior to device encryption.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--f657c643-91c1-4e9f-a8dd-eccdee1e8374","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) can inject its final stage into another process on the targeted system.(Citation: Zscaler PureCrypter JUN 2022)","relationship_id":"relationship--d802c27b-b5b1-4bd6-8c23-858ab395afaf","references":[{"source_name":"Zscaler PureCrypter JUN 2022","description":"Dumont, R. (2022, June 13). Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can inject shellcode into the memory of compromised hosts.(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ESET MirrorFace DEC 2022)(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--9305bc36-68ab-4354-bfa4-6834e028b258","references":[{"source_name":"ESET MirrorFace DEC 2022","description":"Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Kaspersky LODEINFO Part II OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"id":"S9021","name":"DOWNIISSA","url":"https://attack.mitre.org/software/S9021","kind":"malware","description":"[DOWNIISSA](https://attack.mitre.org/software/S9021) can inject shellcode directly into process memory including WINWORD.exe and msiexec.exe.(Citation: Kaspersky LODEINFO OCT 2022)","relationship_id":"relationship--dc78facd-a71c-45d8-bf93-67effda51dfa","references":[{"source_name":"Kaspersky LODEINFO OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can inject code directly into legitimate applications.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--bbe59869-4ae5-4bb5-a300-eba77096846f","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"id":"S9025","name":"NOOPLDR","url":"https://attack.mitre.org/software/S9025","kind":"malware","description":"[NOOPLDR](https://attack.mitre.org/software/S9025) can inject decrypted payloads into processes including wuauclt.exe., rdrleakdiag.exe, and tabcal.exe.(Citation: Trend Micro Earth Kasha NOV 2024)","relationship_id":"relationship--0200e185-a06e-470c-af16-814f84f1f6d7","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has injected itself into a legitimate Windows process.(Citation: QuorumCyber_Vidar_March2023)","relationship_id":"relationship--c0d5dbce-41bf-4b6a-ad07-a9c39b8ed6fa","references":[{"source_name":"QuorumCyber_Vidar_March2023","description":"Quorum Cyber. (n.d.). Malware Analysis Report Vidar - Stealerware. Retrieved August 28, 2026.","url":"https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"}]}],"actors":[{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) has also used [PowerSploit](https://attack.mitre.org/software/S0194)'s <code>Invoke-ReflectivePEInjection.ps1</code> to reflectively load a PowerShell payload into a random process on the victim system.(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--f3055d9f-986e-4202-bb13-c956069bb43f","references":[{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has injected [Remcos](https://attack.mitre.org/software/S0332) into explorer.exe.(Citation: VenereCiscoTalos_Gamaredon_Mar2025)","relationship_id":"relationship--cfe83f83-f0d8-4e17-a396-5571189910fa","references":[{"source_name":"VenereCiscoTalos_Gamaredon_Mar2025","description":"Venere, G. (2025, March 28). Gamaredon campaign abuses LNK files to distribute Remcos backdoor. Retrieved July 23, 2025.","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) malware has injected a Cobalt Strike beacon into Rundll32.exe.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--36af6d80-fef4-40b9-9b32-a2947eadd9e7","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067) injects its malware variant, [ROKRAT](https://attack.mitre.org/software/S0240), into the cmd.exe process.(Citation: Talos Group123)","relationship_id":"relationship--86f8bebc-a5fc-43d7-9af0-0024e07ca8d1","references":[{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"id":"G0068","name":"PLATINUM","url":"https://attack.mitre.org/groups/G0068","kind":"intrusion-set","description":"[PLATINUM](https://attack.mitre.org/groups/G0068) has used various methods of process injection including hot patching.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--ca429946-3c81-4773-8254-108dbdbb9da9","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"G0080","name":"Cobalt Group","url":"https://attack.mitre.org/groups/G0080","kind":"intrusion-set","description":"[Cobalt Group](https://attack.mitre.org/groups/G0080) has injected code into trusted processes.(Citation: Group IB Cobalt Aug 2017)","relationship_id":"relationship--6b083f3f-f8db-403d-b922-308b79d20cc7","references":[{"source_name":"Group IB Cobalt Aug 2017","description":"Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.","url":"https://www.group-ib.com/blog/cobalt"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has injected malicious payloads into the `explorer.exe` process.(Citation: 1 - appv) [APT38](https://attack.mitre.org/groups/G0082) has also injected malicious binaries directly into memory on compromised hosts.(Citation: Microsoft Axios Compromise APR 2026)","relationship_id":"relationship--0321e766-10c1-4215-9fd6-7f712b642dca","references":[{"source_name":"Microsoft Axios Compromise APR 2026","description":"Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"1 - appv","description":"SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"id":"G0091","name":"Silence","url":"https://attack.mitre.org/groups/G0091","kind":"intrusion-set","description":"[Silence](https://attack.mitre.org/groups/G0091) has injected a DLL library containing a Trojan into the fwmain32.exe process.(Citation: Group IB Silence Sept 2018)","relationship_id":"relationship--28a76700-4834-4a1b-bb56-2005bc044e29","references":[{"source_name":"Group IB Silence Sept 2018","description":"Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used Win7Elevate to inject malicious code into explorer.exe.(Citation: Securelist Kimsuky Sept 2013)","relationship_id":"relationship--bd648f03-7313-4e05-bd6e-b499f76a295c","references":[{"source_name":"Securelist Kimsuky Sept 2013","description":"Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.(Citation: FireEye APT41 Aug 2019)","relationship_id":"relationship--e0c1c9b9-b36e-4157-8dc1-26cd9ae25193","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has used process injection to execute payloads to escalate privileges.(Citation: Mandiant FIN12 Oct 2021)","relationship_id":"relationship--3a5b04dd-815c-4f52-be7a-e997625c18e6","references":[{"source_name":"Mandiant FIN12 Oct 2021","description":"Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"id":"G1018","name":"TA2541","url":"https://attack.mitre.org/groups/G1018","kind":"intrusion-set","description":"[TA2541](https://attack.mitre.org/groups/G1018) has injected malicious code into legitimate .NET related processes including  regsvcs.exe, msbuild.exe, and installutil.exe.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)","relationship_id":"relationship--6ada1a93-2fc2-4bd7-bec8-5d41b406e181","references":[{"source_name":"Proofpoint TA2541 February 2022","description":"Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source_name":"Cisco Operation Layover September 2021","description":"Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"id":"G1023","name":"APT5","url":"https://attack.mitre.org/groups/G1023","kind":"intrusion-set","description":"[APT5](https://attack.mitre.org/groups/G1023) has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its functionality.(Citation: Mandiant Pulse Secure Update May 2021)","relationship_id":"relationship--c1341f02-e2be-4c70-8d14-28170bee2133","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","description":"Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) has injected [Cobalt Strike](https://attack.mitre.org/software/S0154) into `wuauclt.exe` during intrusions.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has injected ransomware into `svchost.exe` before encryption.(Citation: Symantec BlackByte 2022)","relationship_id":"relationship--d58f4ef7-4d27-48ba-989d-06b835edae9a","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Symantec BlackByte 2022","description":"Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]},{"id":"G1047","name":"Velvet Ant","url":"https://attack.mitre.org/groups/G1047","kind":"intrusion-set","description":"[Velvet Ant](https://attack.mitre.org/groups/G1047) initial execution included launching multiple `svchost` processes and injecting code into them.(Citation: Sygnia VelvetAnt 2024A)","relationship_id":"relationship--bc4ba2dc-e9f4-4047-959d-c18d0bafcf8a","references":[{"source_name":"Sygnia VelvetAnt 2024A","description":"Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]}],"mitigations":[{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurity, and AppArmor.","relationship_id":"relationship--78af537b-48cc-411d-a209-3e01c44aa87b","references":[]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection. (Citation: win10_asr)","relationship_id":"relationship--bcdd57cf-632f-4fc5-a8e8-d3137cb832e8","references":[{"source_name":"win10_asr","description":"Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}]}],"candidates":[{"id":"0128e48e-8c1a-433a-a11a-a5304734f1e1","name":"UUID custom process Injection","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"The UUIDs Process Injection code was first introduced by the NCC Group. The code can be stored in UUID forms on the heap and converted back to binary via UuidFromStringA at runtime. In this new custom version of UUID injection, EnumSystemLocalesA is the only API called to execute the code. We used custom UuidToString and UuidFromString implementations to avoid using UuidFromStringA and RPCRT4.dll, thereby eliminating the static signatures. This technique also avoided the use of VirtualAlloc, WriteProcessMemory and CreateThread\n\nThe injected shellcode will open a message box and a notepad.\n\nReference to NCC Group: https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/\nConcept from: http://ropgadget.com/posts/abusing_win_functions.html\n","inputs":{"exe_binary":{"description":"PE binary","type":"path","default":"PathToAtomicsFolder\\T1055\\bin\\x64\\uuid_injection.exe"}},"dependencies":[{"description":"Portable Executable to inject must exist at specified location (#{exe_binary})\n"}],"source_definition_sha256":"5033ee720ba808279ef1ff3933e6c7befced90b0dcb7d09a3a71906e63fedc8a"},{"id":"0128e48e-8c1a-433a-a11a-a5387384f1e1","name":"Read-Write-Execute process Injection","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"This test exploited the vulnerability in legitimate PE formats where sections have RWX permission and enough space for shellcode.\nThe RWX injection avoided the use of VirtualAlloc, WriteVirtualMemory, and ProtectVirtualMemory, thus evading detection mechanisms \nthat relied on API call sequences and heuristics. The RWX injection utilises API call sequences: LoadLibrary --> GetModuleInformation --> GetModuleHandleA --> RtlCopyMemory --> CreateThread.\nThe injected shellcode will open a message box and a notepad.\nRWX Process Injection, also known as MockingJay, was introduced to the security community by SecurityJoes.\nMore details can be found at https://www.securityjoes.com/post/process-mockingjay-echoing-rwx-in-userland-to-achieve-code-execution.\nThe original injector and idea were developed for game cheats, as visible at https://github.com/M-r-J-o-h-n/SWH-Injector.\n","inputs":{"vuln_dll":{"description":"vulnerable DLL","type":"path","default":"PathToAtomicsFolder\\T1055\\bin\\x64\\vuln_dll\\msys-2.0.dll"}},"dependencies":[{"description":"Utility to inject must exist on disk at specified location (#{vuln_dll})\n"}],"source_definition_sha256":"38533ba006bc28e5bede87b6a2d7dba236ab4a16736538198737a623205378e6"},{"id":"1c91e740-1729-4329-b779-feba6e71d048","name":"Shellcode execution via VBA","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":2,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"This module injects shellcode into a newly created process and executes. By default the shellcode is created,\nwith Metasploit, for use on x86-64 Windows 10 machines.\n\nNote: Due to the way the VBA code handles memory/pointers/injection, a 64bit installation of Microsoft Office\nis required.\n","inputs":{"txt_path":{"description":"Path to file containing VBA macro to run","type":"path","default":"PathToAtomicsFolder\\T1055\\src\\x64\\T1055-macrocode.txt"}},"dependencies":[{"description":"The 64-bit version of Microsoft Office must be installed\n"},{"description":"\"#{txt_path}\" must exist on disk at specified location\n"}],"source_definition_sha256":"37ecfdf167d4118e19c3abf62b862aa089fa92b857b022c55589aa0dcc7b2cd6"},{"id":"2315ce15-38b6-46ac-a3eb-5e21abef2545","name":"Process Injection with Go using UuidFromStringA WinAPI","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"Uses WinAPI UuidFromStringA to load shellcode to a memory address then executes the shellcode using EnumSystemLocalesA.\nWith this technique, memory is allocated on the heap and does not use commonly suspicious APIs such as VirtualAlloc, WriteProcessMemory, or CreateThread \n- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#uuidfromstringa)\n- References: \n  - https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/\n  - https://twitter.com/_CPResearch_/status/1352310521752662018\n  - https://blog.securehat.co.uk/process-injection/shellcode-execution-via-enumsystemlocala\n","inputs":{},"dependencies":[],"source_definition_sha256":"d7a2fcb1aea9804861dafc6987eaa1af852be6121cac3a81a58b2647e6e86a6c"},{"id":"2871ed59-3837-4a52-9107-99500ebc87cb","name":"Process Injection with Go using CreateThread WinAPI","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"This program executes shellcode in the current process using the following steps\n1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write\n2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space\n3. Change the memory page permissions to Execute/Read with VirtualProtect\n4. Call CreateThread on shellcode address\n5. Call WaitForSingleObject so the program does not end before the shellcode is executed\n\nThis program leverages the functions from golang.org/x/sys/windows to call Windows procedures instead of manually loading them\n\n- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createthread)\n","inputs":{},"dependencies":[],"source_definition_sha256":"31488178f1901c92ad9b555994c4e54fc067d2c75b44993826a9245966020035"},{"id":"2a3c7035-d14f-467a-af94-933e49fe6786","name":"Process Injection with Go using CreateThread WinAPI (Natively)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"This program executes shellcode in the current process using the following steps\n1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write\n2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space\n3. Change the memory page permissions to Execute/Read with VirtualProtect\n4. Call CreateThread on shellcode address\n5. Call WaitForSingleObject so the program does not end before the shellcode is executed\n\nThis program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly.\n\n- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createthreadnative)\n","inputs":{},"dependencies":[],"source_definition_sha256":"d9cba840ae75ece895a7aa641e233ed5293cfdc0aa93cbe4cb9315eb0e9e4363"},{"id":"2a4ab5c1-97ad-4d6d-b5d3-13f3a6c94e39","name":"Remote Process Injection with Go using CreateRemoteThread WinAPI (Natively)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"Leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellcode in a remote process.\n\nThis program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly.\n\n1. Get a handle to the target process\n2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write\n3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process\n4. Change the memory page permissions to Execute/Read with VirtualProtectEx\n5. Execute the entrypoint of the shellcode in the remote process with CreateRemoteThread\n6. Close the handle to the remote process\n\n- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createremotethreadnative)\n","inputs":{"spawn_process_path":{"description":"Path of the binary to spawn","type":"string","default":"C:\\Windows\\System32\\werfault.exe"},"spawn_process_name":{"description":"Name of the process spawned","type":"string","default":"werfault"}},"dependencies":[],"source_definition_sha256":"5193f1d4e0833fa1c9b4af273dad856db256f183cbd68b29c2ae1d90ed5a7f97"},{"id":"3203ad24-168e-4bec-be36-f79b13ef8a83","name":"Remote Process Injection in LSASS via mimikatz","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":2,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"Use mimikatz to remotely (via psexec) dump LSASS process content for RID 500 via code injection (new thread).\nEspecially useful against domain controllers in Active Directory environments.\nIt must be executed in the context of a user who is privileged on remote `machine`.\n\nThe effect of `/inject` is explained in <https://blog.3or.de/mimikatz-deep-dive-on-lsadumplsa-patch-and-inject.html>\n","inputs":{"machine":{"description":"machine to target (via psexec)","type":"string","default":"DC1"},"mimikatz_path":{"description":"Mimikatz windows executable","type":"path","default":"%tmp%\\mimikatz\\x64\\mimikatz.exe"},"psexec_path":{"description":"Path to PsExec","type":"string","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\PsExec.exe"}},"dependencies":[{"description":"Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})\n"},{"description":"PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_path})\n"}],"source_definition_sha256":"d5a8241e56ff07ee429bdb6c27553fc1c944e3f3d30093e9a7891e0096759799"},{"id":"49543237-25db-497b-90df-d0a0a6e8fe2c","name":"Dirty Vanity process Injection","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"This test used the Windows undocumented remote-fork API RtlCreateProcessReflection to create a cloned process of the parent process\nwith shellcode written in its memory. The shellcode is executed after being forked to the child process. The technique was first presented at \nBlackHat Europe 2022. Shellcode will open a messsage box and a notepad.\n","inputs":{"pid":{"description":"Parent process ID","type":"string","default":"(Start-Process calc.exe -PassThru).Id"}},"dependencies":[],"source_definition_sha256":"9330531a072a2e1feb729f1209d0e7ccd485c5f4562a8dafb729fedcc042619e"},{"id":"69534efc-d5f5-4550-89e6-12c6457b9edd","name":"Remote Process Injection with Go using CreateRemoteThread WinAPI","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"Leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellocde in a remote process.\n\nThis application leverages functions from the golang.org/x/sys/windows package, where feasible, like the windows.OpenProcess().\n\nSteps taken with this technique\n1. Get a handle to the target process\n2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write\n3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process\n4. Change the memory page permissions to Execute/Read with VirtualProtectEx\n5. Execute the entrypoint of the shellcode in the remote process with CreateRemoteThread\n6. Close the handle to the remote process\n\n- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createremotethread)\n - References:\n  - https://www.ired.team/offensive-security/code-injection-process-injection/process-injection\n","inputs":{"spawn_process_path":{"description":"Path of the binary to spawn","type":"string","default":"C:\\Windows\\System32\\werfault.exe"},"spawn_process_name":{"description":"Name of the process spawned","type":"string","default":"werfault"}},"dependencies":[],"source_definition_sha256":"e65bc29564c8f276434f331a8adb91eb73dd0f8255b9eba238ff75513839d169"},{"id":"7362ecef-6461-402e-8716-7410e1566400","name":"Process Injection with Go using EtwpCreateEtwThread WinAPI","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"Uses EtwpCreateEtwThread function from ntdll.dll to execute shellcode within the application's process.\nThis program loads the DLLs and gets a handle to the used procedures itself instead of using the windows package directly.\n\nSteps taken with this technique\n1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write\n2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space\n3. Change the memory page permissions to Execute/Read with VirtualProtect\n4. Call EtwpCreateEtwThread on shellcode address\n5. Call WaitForSingleObject so the program does not end before the shellcode is executed\n\n- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#EtwpCreateEtwThread)\n- References: \n  - https://gist.github.com/TheWover/b2b2e427d3a81659942f4e8b9a978dc3\n  - https://www.geoffchappell.com/studies/windows/win32/ntdll/api/etw/index.htm\n","inputs":{},"dependencies":[],"source_definition_sha256":"3a23ffbaae359a8998698429d4e94094cc69a71dab1083132587121ec550c573"},{"id":"a0c1725f-abcd-40d6-baac-020f3cf94ecd","name":"Remote Process Injection with Go using RtlCreateUserThread WinAPI","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"Executes shellcode in a remote process.\n\nSteps taken with this technique\n1. Get a handle to the target process\n2. Allocate memory for the shellcode with VirtualAllocEx setting the page permissions to Read/Write\n3. Use the WriteProcessMemory to copy the shellcode to the allocated memory space in the remote process\n4. Change the memory page permissions to Execute/Read with VirtualProtectEx\n5. Execute the entrypoint of the shellcode in the remote process with RtlCreateUserThread\n6. Close the handle to the remote process\n\n- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#rtlcreateuserthread)\n- References: \n  - https://www.cobaltstrike.com/blog/cobalt-strikes-process-injection-the-details-cobalt-strike\n","inputs":{"spawn_process_path":{"description":"Path of the binary to spawn","type":"string","default":"C:\\Windows\\System32\\werfault.exe"},"spawn_process_name":{"description":"Name of the process spawned","type":"string","default":"werfault"}},"dependencies":[],"source_definition_sha256":"9be3620cb1bb0db2abdf69af738be674e93453219b554d5c7ce634a180698093"},{"id":"c6952f41-6cf0-450a-b352-2ca8dae7c178","name":"Section View Injection","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1055/T1055.yaml","description":"This test creates a section object in the local process followed by a local section view.\nThe shellcode is copied into the local section view and a remote section view is created in the target process, pointing to the local section view. \nA thread is then created in the target process, using the remote section view as start address.\n","inputs":{},"dependencies":[],"source_definition_sha256":"3b0bf37a91a9439848ceb21b41c3ba2d3bd3790602dd82373799fa36a90e8586"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1055":"/ttp-simulation/techniques/enterprise/T1055/","T1106":"/ttp-simulation/techniques/enterprise/T1106/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1055","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0020","collector":"illustrative-lab-collector","observation":{"process_id":4200,"observation":"process_image_changed","sensor":"lab-instrumentation"}}]}}