T1055 Process Injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. MITRE ATT&CK

3 programs on CmdID 16 Sigma rules T1055 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1055.001Process Injection: Dynamic-link Library Injection

T1055.009Process Injection: Proc Memory

T1055.012Process Injection: Process Hollowing

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

criticalHackTool - DInjector PowerShell Cradle ExecutionFlorian Roth (Nextron Systems) · Windows

criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

highDllhost.EXE Execution AnomalyNasreddine Bencherchali (Nextron Systems) · Windows

highExecution Of Non-Existing FileMax Altgelt (Nextron Systems) · Windows

highHackTool - CoercedPotato ExecutionFlorian Roth (Nextron Systems) · Windows

highSuspect Svchost ActivityDavid Burkett, @signalblur · Windows

highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems) · Windows

highSuspicious Rundll32 Invoking Inline VBScriptFlorian Roth (Nextron Systems) · Windows

mediumProcess Creation Using Sysnative FolderMax Altgelt (Nextron Systems) · Windows

mediumSuspicious Cross-User Process SpawnSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumSuspicious Userinit Child ProcessFlorian Roth (Nextron Systems), Samir Bousseaden (idea) · Windows