T1055 Process Injection — Detection Rules

Source-backed rule directory

• Rare Remote Thread Creation By Uncommon Source Image · test · high · {"product":"windows","category":"create_remote_thread"}
• Remote Thread Creation By Uncommon Source Image · test · medium · {"product":"windows","category":"create_remote_thread"}
• Created Files by Microsoft Sync Center · test · medium · {"product":"windows","category":"file_event"}
• Potential DLL Sideloading Using Coregen.exe · test · medium · {"category":"image_load","product":"windows"}
• DotNet CLR DLL Loaded By Scripting Applications · test · high · {"category":"image_load","product":"windows"}
• Network Connection Initiated Via Notepad.EXE · test · high · {"category":"network_connection","product":"windows"}
• Microsoft Sync Center Suspicious Network Connections · test · medium · {"product":"windows","category":"network_connection"}
• CobaltStrike Named Pipe · test · critical · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
• CobaltStrike Named Pipe Pattern Regex · test · critical · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
• CobaltStrike Named Pipe Patterns · test · high · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
• HackTool - CoercedPotato Named Pipe Creation · test · high · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
• HackTool - EfsPotato Named Pipe Creation · test · high · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
• Malicious Named Pipe Created · test · critical · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
• PowerShell ShellCode · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Dllhost.EXE Execution Anomaly · test · high · {"category":"process_creation","product":"windows"}
• HackTool - CoercedPotato Execution · test · high · {"category":"process_creation","product":"windows"}
• HackTool - DInjector PowerShell Cradle Execution · test · critical · {"category":"process_creation","product":"windows"}
• Potential Process Injection Via Msra.EXE · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Rundll32 Invoking Inline VBScript · test · high · {"category":"process_creation","product":"windows"}
• Process Creation Using Sysnative Folder · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Userinit Child Process · test · medium · {"category":"process_creation","product":"windows"}
• Suspect Svchost Activity · test · high · {"category":"process_creation","product":"windows"}
• Uncommon Svchost Command Line Parameter · experimental · high · {"category":"process_creation","product":"windows"}
• Suspicious Child Process Of Wermgr.EXE · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1055 Process Injection

MATCH(remote_thread_creation OR cross_process_memory_write OR suspicious_process_access) AND source_process NOT_IN approved_injectors -> ALERT

• Endpoint Detection and Response Telemetry
• Memory-Protection and Exploit-Mitigation Logs
• System-Call Telemetry
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0508 Behavioral Detection of Process Injection Across Platforms

AN1399 Analytic 1399

Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.

AN1400 Analytic 1400

Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.

AN1401 Analytic 1401

Detects memory-based injection by monitoring `task_for_pid`, `mach_vm_write`, and dylib injection patterns through `DYLD_INSERT_LIBRARIES` or manual memory mapping.