1200KM / detection
T1055.005 Thread Local Storage — Detection Rules
Detection workspace for T1055.005 Thread Local Storage: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0467 Detection Strategy for TLS Callback Injection via PE Memory Modification and Hollowing
AN1289 Analytic 1289
Detects thread local storage (TLS) callback injection by monitoring memory modifications to PE headers and TLS directory structures during or after process hollowing events, followed by anomalous thread behavior prior to main entry point execution.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1055.005 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.