{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1631","id":"T1631","name":"Process Injection","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1631","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"8aaacf1ac36f60c6e33df63739d80f73814f6303429458ccbd515203f69f02c2","description":"Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nBoth Android and iOS have no legitimate way to achieve process injection. The only way this is possible is by abusing existing root access or exploiting a vulnerability.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1631","external_id":"T1631"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"mobile/T1631.001","id":"T1631.001","name":"Ptrace System Calls","page":"techniques/mobile/T1631.001/"}],"telemetry":[{"id":"DC0018","name":"Host Status","page":"telemetry/DC0018/","kind":"attack_component","category":"Host state and inventory","description":"Host health and availability observations such as heartbeat, shutdown or degraded state.","collection_focus":"Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","status","heartbeat_age_seconds","collector_healthy"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"mobile/T1631","id":"T1631","name":"Process Injection","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1631","technique_page":"techniques/mobile/T1631/","page":"detections/mobile/T1631/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0632","name":"Detection of Process Injection","url":"https://attack.mitre.org/detectionstrategies/DET0632","stix_id":"x-mitre-detection-strategy--b76b67bc-d38b-4b63-a0d0-ebfc7f829db6","relationship_id":"relationship--d3129d65-5d7f-434b-b2c7-043a6d8488e7","description":"","analytics":[{"id":"AN1703","name":"Analytic 1703","guidance":"For Android, detect Process Injection by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Access via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: accessibility_service or notification_listener appears attributed to a bundle IN $LegitimateSystemProcesses$ within $InjectionWindow$ of root detection — injected code requesting special permissions under a legitimate system process identit]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0632#AN1703","platforms":["Android"],"tuning":[{"field":"LegitimateSystemProcesses","description":"com.android.systemui, android.process.media, com.android.phone — high-value injection targets."},{"field":"InjectionWindow","description":"Default 600s after root detection."},{"field":"ProcessBaselineDomains","description":"Per-process network destination baseline for system processes."}],"log_sources":[{"component_id":"DC0018","component":"Host Status","name":"android:DevicePolicyManager","channel":"DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported","platforms":["Android"],"analytic_id":"AN1703","source_url":"https://attack.mitre.org/detectionstrategies/DET0632#AN1703","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"android:EnterpriseNetworkLog","channel":"DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata","platforms":["Android"],"analytic_id":"AN1703","source_url":"https://attack.mitre.org/detectionstrategies/DET0632#AN1703","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0035","component":"Process Access","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: accessibility_service or notification_listener appears attributed to a bundle IN $LegitimateSystemProcesses$ within $InjectionWindow$ of root detection — injected code requesting special permissions under a legitimate system process identit","platforms":["Android"],"analytic_id":"AN1703","source_url":"https://attack.mitre.org/detectionstrategies/DET0632#AN1703","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]},{"id":"AN1704","name":"Analytic 1704","guidance":"For iOS, detect Process Injection by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Process Access via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: kernel log entry at level=fault referencing task_for_pid or get-task-allow violation on SUPERVISED device with Unified Log forwarding — kernel records entitlement violations at fault level; requires supervised MDM with Unified Log export]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0632#AN1704","platforms":["iOS"],"tuning":[{"field":"AppBaselineDomains","description":"Per-device CDN baseline. Derive by 30-day measurement."},{"field":"IntegrityCheckWindow","description":"Default 900s — MDM check-in interval."}],"log_sources":[{"component_id":"DC0018","component":"Host Status","name":"iOS:MDM","channel":"DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries","platforms":["iOS"],"analytic_id":"AN1704","source_url":"https://attack.mitre.org/detectionstrategies/DET0632#AN1704","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1704","source_url":"https://attack.mitre.org/detectionstrategies/DET0632#AN1704","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0035","component":"Process Access","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: kernel log entry at level=fault referencing task_for_pid or get-task-allow violation on SUPERVISED device with Unified Log forwarding — kernel records entitlement violations at fault level; requires supervised MDM with Unified Log export","platforms":["iOS"],"analytic_id":"AN1704","source_url":"https://attack.mitre.org/detectionstrategies/DET0632#AN1704","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]}]}],"telemetry_references":[{"id":"DC0018","name":"Host Status","tag":"Host Status","page":"telemetry/DC0018/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) injects libcynject.dylib into the SpringBoard process to enable audio/video recording.(Citation: LinkedIn Dmitry LightSpy 2025) ","relationship_id":"relationship--a394e5e5-1d98-4e08-ba29-866cf7ff9a62","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"}]},{"id":"S1208","name":"FjordPhantom","url":"https://attack.mitre.org/software/S1208","kind":"malware","description":"[FjordPhantom](https://attack.mitre.org/software/S1208) has injected malicious code   and a hooking framework through a virtualization solution, i.e. [Virtualization Solution](https://attack.mitre.org/techniques/T1670), into the process of the hosted application.(Citation: Promon FjordPhantom Oct2024) ","relationship_id":"relationship--6d38782e-2c88-411b-8328-72347d4c6024","references":[{"source_name":"Promon FjordPhantom Oct2024","description":"Promon Security Research Team. (2024, October 1). Retrieved February 19, 2025.","url":"https://promon.io/security-news/fjordphantom-android-malware"}]}],"actors":[],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1631":"/ttp-simulation/techniques/mobile/T1631/","T1670":"/ttp-simulation/techniques/mobile/T1670/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1631","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}}]}}