Wiki › Techniques, Tactics & Procedures (TTPs) › Defense Evasion › Process Injection Techniques

Process Injection Techniques

2 min read

Jump to:

Overview

Process injection techniques involve an adversary inserting malicious code into the address space of another process to execute code stealthily. This approach enables attackers to evade detection, maintain persistence, and escalate privileges by leveraging legitimate processes. Process injection is commonly employed during execution, persistence, and defense evasion stages of the attack lifecycle.

Attack Objective

Gain stealthy code execution and control over system processes
Supports Execution, Persistence, Privilege Escalation, and Defense Evasion stages
Advances attacker position by hiding malicious activity within trusted processes and bypassing security controls

How the Technique Works

Process injection works by manipulating the memory or execution context of a legitimate process to run attacker-controlled code. This can involve writing shellcode into another process’s memory, hijacking threads, or altering process entry points. The injected code executes with the privileges of the host process, allowing attackers to blend their actions with normal system operations.

Common Methods & Variations

Classic DLL injection, reflective DLL injection, and code cave injection
Remote thread injection, process hollowing, and thread hijacking
Variants targeting on-premises endpoints, cloud workloads, and identity tokens
Use of living-off-the-land binaries (LOLBins) versus custom or third-party tools

Indicators of Compromise (IOCs)

Unexpected process behavior such as anomalous memory allocations or thread creation
Suspicious API calls related to memory manipulation and thread control in logs
Unusual parent-child process relationships and process injection artifacts on endpoints
Network anomalies from injected processes communicating with external infrastructure

Detection Strategies

Monitoring endpoint telemetry for process creation, memory writes, and thread injections
Behavioral detection focusing on anomalous process interactions rather than static signatures
Correlation of process anomalies with network activity and user behavior analytics

Mitigation & Prevention

Implement application whitelisting and restrict code execution privileges
Harden process permissions and enable exploit mitigation features like DEP and ASLR
Enforce least privilege principles and monitor for misuse of administrative credentials

Response Considerations

Isolate affected systems to prevent lateral movement
Conduct memory forensics and process analysis to identify injected code and entry points
Remove malicious code, patch vulnerabilities, and strengthen endpoint defenses post-incident

Related Techniques

Process Hollowing and DLL Side-Loading as complementary execution methods
Credential Dumping and Privilege Escalation techniques often follow injection
Command and Control channels established through injected processes

Mapping & References

MITRE ATT&CK Techniques: T1055 (Process Injection), with sub-techniques such as T1055.001 (DLL Injection), T1055.003 (Thread Execution Hijacking)
Public research and advisories on process injection detection and mitigation from cybersecurity vendors and CERTs

Tags: Adversary Tactics Attack Techniques cyber threats Defense Evasion endpoint security Execution MITRE ATT&CK persistence privilege escalation Process Injection