Cross-source coverage

T1055 / ATT&CK

Process Injection

349 rules · 335 families across 8 sources.

12 deprecated hidden · include 1 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific.

More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Tactics: Stealth · Privilege Escalation
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:Sysmonetw:Microsoft-Windows-Kernel-Processauditd:SYSCALLlinux:procfsmacos:unifiedlogmacos:endpointsecuritymacos:syslog

How MITRE says to detect it DET0508

Behavioral Detection of Process Injection Across Platforms

Windows Analytic 1399

Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.

WinEventLog:Sysmon EventCode=10
WinEventLog:Sysmon EventCode=1
WinEventLog:Sysmon EventCode=7
etw:Microsoft-Windows-Kernel-Process API calls

Linux Analytic 1400

Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.

auditd:SYSCALL ptrace, mmap, process_vm_writev
auditd:SYSCALL open
linux:procfs /proc/[pid]/maps, /proc/[pid]/mem

macOS Analytic 1401

Detects memory-based injection by monitoring `task_for_pid`, `mach_vm_write`, and dylib injection patterns through `DYLD_INSERT_LIBRARIES` or manual memory mapping.

macos:unifiedlog subsystem=com.apple.security, library=libsystem_kernel.dylib
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP
macos:syslog DYLD_INSERT_LIBRARIES anomalies

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 349 above — a rule tagged a sub-technique covers this technique too.

elastic/protections-artifacts

176 rules

Detection	Severity	Format
API Call from a Process with a Spoofed Parent	Undefined	Elastic TOML
API Call from a Suspicious Stack	Undefined	Elastic TOML
API Call via Jump ROP Gadget	Undefined	Elastic TOML
API Call via Timer Callback Event	Undefined	Elastic TOML
API via Callback from a Suspicious Stack	Undefined	Elastic TOML
API via Trusted App Runtime DLL	Undefined	Elastic TOML
Application Javascript Injection via Nodejs	Undefined	Elastic TOML
Asynchronous Procedure Call from Unusual Module	Undefined	Elastic TOML
Common Language Runtime Loaded via an Unsigned Module	Undefined	Elastic TOML
Cross Process API Activity with Truncated Stack	Undefined	Elastic TOML

+ 166 more from elastic/protections-artifacts → showing the 10 highest-severity

SigmaHQ/sigma

53 rules

Detection	Severity	Format
Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection	Critical	Sigma
CobaltStrike Named Pipe	Critical	Sigma
CobaltStrike Named Pipe Pattern Regex	Critical	Sigma
HackTool - DInjector PowerShell Cradle Execution	Critical	Sigma
Malicious Named Pipe Created	Critical	Sigma
Potential Dridex Activity	Critical	Sigma
RedSun - Named Pipe Created	Critical	Sigma
RedSun - TieringEngineService.exe Detected as EICAR Test File	Critical	Sigma
APT PRIVATELOG Image Load Pattern	High	Sigma
ASLR Disabled Via Sysctl or Direct Syscall - Linux	High	Sigma

+ 43 more from SigmaHQ/sigma → showing the 10 highest-severity

Wazuh Core Ruleset

39 rules · 25 families

Detection	Severity	Format
Windows Remote Dektop utility process was accessed by , possible process injection · win.eventdata.targetImage = (?i)mstsc\.exe	Critical	Wazuh XML
Explorer process was accessed by , possible process injection · win.eventdata.targetImage = (?i)explorer\.exe	High	Wazuh XML
Local Security Authority Subsystem Service (LSASS) process was accessed by , possible code injection for credential dumping · win.eventdata.targetImage = (?i)lsass\.exe	High	Wazuh XML
Multiple common web attacks from same source ip.	High	Wazuh XML
Possible code injection on explorer.exe by · win.eventdata.targetImage = (?i)[c-z]:\\\\Windows\\\\explorer\.exe	High	Wazuh XML
Possible code injection on mstsc.exe (Windows RDP utility) by · win.eventdata.targetImage = (?i)\\\\mstsc\.exe	High	Wazuh XML
source ip.	High	Wazuh XML
Sysmon - Suspicious Process - csrss.exe 2 variants	High	Wazuh XML
Sysmon - Suspicious Process - csrss.exe 2 variants	High	Wazuh XML
Sysmon - Suspicious Process - dllhost.exe 2 variants	High	Wazuh XML

+ 29 more from Wazuh Core Ruleset → showing the 10 highest-severity

splunk/security_content

39 rules

Detection	Severity	Format
AWS Bedrock Claude excessive use of tokens	Undefined	SPL
AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation	Undefined	SPL
AWS Bedrock Claude Hostile Prompt Sentiment	Undefined	SPL
AWS Bedrock Claude Possible Prompt Injection	Undefined	SPL
AWS Bedrock Claude Sensitive Data in Prompts	Undefined	SPL
AWS Bedrock Claude Unusually Large Prompts	Undefined	SPL
Cisco NVM - Non-Network Binary Making Network Connection	Undefined	SPL
Cisco NVM - Suspicious Network Connection From Process With No Args	Undefined	SPL
Cisco Secure Firewall - Communication Over Suspicious Ports	Undefined	SPL
Create Remote Thread In Shell Application	Undefined	SPL

+ 29 more from splunk/security_content → showing the 10 highest-severity

elastic/detection-rules

25 rules

Detection	Severity	Format
Conhost Spawned By Suspicious Parent Process	High	Elastic TOML
Memory Threat - Detected - Elastic Defend	High	Elastic TOML
Memory Threat - Prevented- Elastic Defend	High	Elastic TOML
Potential Process Injection via PowerShell	High	Elastic TOML
Process Injection - Detected - Elastic Endgame	High	Elastic TOML
Suspicious Managed Code Hosting Process	High	Elastic TOML
Suspicious Process Access via Direct System Call	High	Elastic TOML
Unusual Child Process from a System Virtual Process	High	Elastic TOML
Potential PowerShell HackTool Script by Function Names	Medium	Elastic TOML
Potential Sudo Token Manipulation via Process Injection	Medium	Elastic TOML

+ 15 more from elastic/detection-rules → showing the 10 highest-severity

socfortress/Wazuh-Rules

13 rules

Detection	Severity	Format
Sysmon - Event 1: Process creation · ListPlanting Execution (T1055.015)	Critical	Wazuh XML
Powershell script: Code injection cmdlet detected	High	Wazuh XML
Powershell script: GetProcAddress API call detected (fileless injection)	High	Wazuh XML
Powershell script: Suspicious keyword (shellcode/injection/backdoor)	High	Wazuh XML
Sysmon - Event 1: Process creation · APC Injection Tools Execution (T1055.004)	High	Wazuh XML
Sysmon - Event 1: Process creation · InjectContext.exe Execution (T1055.003)	High	Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Process Hollowing Start-Hollow.ps1 (T1055.012)	High	Wazuh XML
Sysmon - Event 10: ProcessAccess by · Dynamic-link Library Injection (T1055.001)	Low	Wazuh XML
Sysmon - Event 10: ProcessAccess by · Process Injection (T1055)	Low	Wazuh XML
Sysmon - Event 17: PipeEvent (Pipe Created) by · win.eventdata.RuleName = technique_id=T1055; Possible Cobalt Strike post-exploitatio…	Low	Wazuh XML

+ 3 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

Azure/Azure-Sentinel

3 rules

Detection	Severity	Format
Solorigate Named Pipe	High	KQL
Anomalous .NET runtime loading for fileless payload	Undefined	KQL
Potential Process Doppelganging	Undefined	KQL

falcosecurity/rules

1 rule

Detection	Severity	Format
PTRACE attached to process	Medium	Falco YAML