Process Injection

What is Process Injection?

“Process Injection is documented as technique T1055 in MITRE ATT&CK® v19.1 under the Privilege Escalation tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Process Injection activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for suspicious use of Windows API functions associated with remote process injection including OpenProcess with PROCESS_VM_WRITE, WriteProcessMemory, CreateRemoteThread, and NtQueueApcThread targeting other processes.

2. 2

   Alert on process hollowing indicators including processes created in a suspended state followed immediately by WriteProcessMemory calls, SuspendThread and ResumeThread sequences, and processes with mismatched image paths in memory versus disk.

3. 3

   Detect unusual memory allocation patterns in legitimate processes, including executable memory regions allocated by external processes, which is a signature of shellcode injection techniques used to load code into trusted host processes.

4. 4

   Monitor for cross-process memory access to sensitive processes including lsass.exe, browser processes, and security tool processes from unexpected parent processes, as these are high-value injection targets for credential theft and defense evasion.

5. 5

   Track processes that exhibit network activity inconsistent with their typical behavior following periods where remote thread creation was observed, as injected code frequently establishes C2 communications through the host process network context.

Example Alerts

These realistic alert examples show what Process Injection looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Process Injection?

Detection centers on XDR, SIEM telemetry for the privilege escalation phase of the attack. Monitor for suspicious use of Windows API functions associated with remote process injection including OpenProcess with PROCESS_VM_WRITE, WriteProcessMemory, CreateRemoteThread, and NtQueueApcThread targeting other processes. Alert on process hollowing indicators including processes created in a suspended state followed immediately by WriteProcessMemory calls, SuspendThread and ResumeThread sequences, and processes with mismatched image paths in memory versus disk.

What does a Process Injection alert look like?

A representative XDR detection is "Process Hollowing Detected Against svchost.exe" (critical severity): EDR telemetry captured process hollowing sequence: a malicious loader created svchost.exe in suspended state, unmapped the legitimate image using NtUnmapViewOfSection, wrote malicious shellcode into the process address space, and resumed execution. The hollowed svchost.exe process now runs attacker-controlled code while appearing as a legitimate Windows service host in task listings and security monitoring dashboards.

Which tools detect Process Injection, and how can I practice?

Process Injection (T1055) is best surfaced with XDR, SIEM telemetry, which exposes the privilege escalation signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.