CmdID / Techniques / T1055

T1055.001 Process Injection: Dynamic-link Library Injection

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. MITRE ATT&CK

1 program on CmdID 6 Sigma rules T1055.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1055Process Injection

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

tracker.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highManageEngine Endpoint Central Dctask64.EXE Potential AbuseFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highMavinject Inject DLL Into Running Processfrack113, Florian Roth · Windows

highRenamed Mavinject.EXE Executionfrack113, Florian Roth · Windows

highRenamed ZOHO Dctask64 ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highTAIDOOR RAT DLL LoadFlorian Roth (Nextron Systems) · Windows

mediumPotential DLL Injection Or Execution Using Tracker.exeAvneet Singh @v3t0_, oscd.community · Windows