Process Injection

One-liner: A defense evasion technique where attackers inject malicious code into legitimate running processes to execute stealthily and evade security controls.

🎯 What Is It?

Process injection (MITRE ATT&CK T1055) is a method used by adversaries to execute arbitrary code within the address space of a separate, legitimate process. By injecting code into trusted processes (like explorer.exe, svchost.exe), attackers can:

• Evade detection — Security tools may whitelist the target process
• Bypass application whitelisting — Code runs under a trusted process name
• Gain elevated privileges — Inherit permissions of the target process
• Maintain stealth — No separate malicious process visible in Task Manager

🔬 How It Works

Common Injection Techniques

Classic DLL Injection Flow

1. OpenProcess()        → Get handle to target process
2. VirtualAllocEx()     → Allocate memory in target process
3. WriteProcessMemory() → Write malicious DLL path/code
4. CreateRemoteThread() → Execute code in target process

Process Hollowing Flow

1. CreateProcess()      → Start legitimate process (SUSPENDED)
2. NtUnmapViewOfSection() → Hollow out the process image
3. VirtualAllocEx()     → Allocate space for malicious code
4. WriteProcessMemory() → Write malicious executable
5. SetThreadContext()   → Point entry to malicious code
6. ResumeThread()       → Execute the malicious payload

🕵️ Detection & Prevention

How to Detect

KQL Example (from THM Threat Hunting Foothold)

# Hunt for CreateRemoteThread events
host.name: WKSTN-* AND winlog.event_id: 8

Suspicious Indicators

• Non-system processes creating threads in explorer.exe, svchost.exe
• Processes with unusual memory allocations (RWX permissions)
• User-mode process injecting into SYSTEM processes
• Processes loading DLLs from unusual locations (%TEMP%, %APPDATA%)

How to Prevent / Mitigate

• Credential Guard — Protects LSASS from injection
• Antivirus (AV) with behavior monitoring
• Windows Defender Attack Surface Reduction (ASR) rules
• Code Integrity policies — Block unsigned DLLs
• Network segmentation — Limit lateral movement post-injection

📊 Common Target Processes

🎤 Interview Angles

Common Questions

• "What is process injection and why do attackers use it?"
• "How would you detect process injection in your environment?"
• "What's the difference between process hollowing and DLL injection?"
• "Which Sysmon events help detect process injection?"

STAR Story

Situation: EDR flagged unusual activity but couldn't identify the source—malicious behavior appeared to come from explorer.exe.
Task: Investigate the alert and determine if it was a true positive.
Action: Used Sysmon Event ID 8 (CreateRemoteThread) to identify that a downloaded chrome.exe from C:\Users\...\Downloads had injected into explorer.exe. Correlated with Event ID 11 showing the file was downloaded via browser.
Result: Confirmed process injection attack. Isolated the endpoint, extracted the malicious binary for analysis, and created detection rule for CreateRemoteThread from user-writable directories.

✅ Best Practices

• Enable Sysmon with configuration capturing Event IDs 8 and 10
• Monitor for unusual parent-child process relationships
• Alert on CreateRemoteThread from non-system processes
• Use memory forensics for advanced injection detection
• Implement behavioral detection alongside signature-based

❌ Common Misconceptions

• "Only malware uses these APIs" — Legitimate software (debuggers, AV) also use them; context matters
• "Process injection always leaves file artifacts" — Many techniques are fileless (memory-only)
• "Sysmon catches all injection" — Some advanced techniques evade standard Sysmon configs

🔗 Related Concepts

• Defense Evasion
• MITRE ATT&CK
• Sysmon
• Living off the Land (LOLBAS)
• Persistence (Cyber Security)
• Malware Analysis
• Threat Hunting

📚 References

• MITRE ATT&CK T1055: https://attack.mitre.org/techniques/T1055/
• Elastic Detection Rules for Process Injection
• Red Canary Threat Detection Report