Process Injection Techniques

MITRE ATT&CK T1055 · Technical reference for red team operations and blue team detection

Why Process Injection Matters

✓Runs under the identity and privileges of a trusted process

✓Avoids creating obvious new processes

✓Blends with normal system activity (especially with Living Off The Land binaries)

✓Achieves fileless or low-on-disk operation

Modern EDRs heavily monitor these behaviors, so understanding the techniques helps both red and blue teams.

DLL Injection

T1574.001

Load a malicious DLL into a process address space via LoadLibrary or manual mapping.

Difficulty: Medium•Detection: Monitor CreateRemoteThread calls with LoadLibrary start addressCheck for unsigned DLLs loaded into signed processesWatch for unusual DLL paths (temp folders, user directories)Sysmon Event ID 7 (Image loaded)

Process Hollowing / Shellcode Injection

T1055.012

Replace legitimate process memory with malicious shellcode while keeping the process appearance intact.

Difficulty: High•Detection: Monitor NtUnmapViewOfSection followed by VirtualAllocExCheck for suspended processes created then modifiedLook for memory regions with RWX permissionsETW: Microsoft-Windows-Threat-Intelligence events

APC Injection (Asynchronous Procedure Call)

T1055.004

Queue malicious code to execute when a thread enters an alertable state.

Difficulty: Medium•Detection: Monitor QueueUserAPC calls targeting non-self processesWatch for alertable state functions (SleepEx, WaitForSingleObjectEx)Check for unusual APC queues in system threads

AtomBombing

T1055.013

Use Windows global atom tables to pass shellcode between processes.

Difficulty: High•Detection: Monitor GlobalAddAtom with suspicious data sizesWatch for unusual APC combinations with atom table accessCheck for processes calling GlobalGetAtomName unexpectedly

Thread Hijacking

T1055

Suspend an existing thread, modify its context to point to shellcode, then resume.

Difficulty: High•Detection: Monitor SuspendThread + SetThreadContext combinationsWatch for thread context changes to unusual memory regionsCheck for RWX memory in thread execution paths

Educational Purpose: This material is for authorized security research, penetration testing, and defensive security operations only. Always operate within legal boundaries and with proper authorization.