Detect Dynamic-link Library Injection in Microsoft Sentinel
Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). Variations include reflective DLL injection (self-mapping DLL), memory module loading, and Module Stomping/DLL Hollowing where a legitimate DLL is loaded then its AddressOfEntryPoint is overwritten before execution.
MITRE ATT&CK
- Technique
- T1055 Process Injection
- Sub-technique
- T1055.001 Dynamic-link Library Injection
- Canonical reference
- https://attack.mitre.org/techniques/T1055/001/
KQL Detection Query
// Detect DLL injection via CreateRemoteThread targeting LoadLibrary
let SuspiciousInjectors = dynamic(["rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "CreateRemoteThreadApiCall"
| project Timestamp, DeviceName, AccountName,
InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId,
FileName, ProcessId, ProcessCommandLine
| join kind=leftouter (
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName !startswith "C:\\Windows\\System32\\"
| where FileName !startswith "C:\\Windows\\SysWOW64\\"
| where FileName !startswith "C:\\Program Files"
| project LoadTime=Timestamp, DeviceName, ProcessId=InitiatingProcessId, LoadedDLL=FileName, SHA256
) on DeviceName, ProcessId
| where isnotempty(LoadedDLL)
| extend SuspiciousSource = InitiatingProcessFileName in~ (SuspiciousInjectors)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, LoadedDLL, SHA256, SuspiciousSource
| sort by Timestamp descDetects DLL injection by correlating CreateRemoteThread events with subsequent DLL loads from non-standard locations in the target process. Joins DeviceEvents (for the injection API call) with DeviceImageLoadEvents (for the loaded DLL) to identify when a remote thread triggers loading of a DLL from a suspicious path (outside System32, SysWOW64, and Program Files). Highlights known LOLBin injectors.
Data Sources
Required Tables
False Positives & Tuning
- EDR and antivirus products injecting monitoring DLLs (e.g., CrowdStrike csagent.dll, SentinelOne hooks)
- Application compatibility framework (apphelp.dll) loading shim DLLs into processes
- Software instrumentation tools (AppDynamics, Dynatrace) injecting agent DLLs for APM monitoring
- Browser extensions and plugins loading DLLs into browser processes
Other platforms for T1055.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1DLL Injection via mavinject.exe (LOLBAS)
Expected signal: Sysmon Event ID 1: Process Create for mavinject.exe with CommandLine containing /INJECTRUNNING. Sysmon Event ID 8: CreateRemoteThread from mavinject.exe targeting notepad.exe. Sysmon Event ID 7: ImageLoad of amsi.dll in notepad.exe process.
- Test 2Reflective DLL Injection via PowerSploit Invoke-DllInjection
Expected signal: Sysmon Event ID 1: PowerShell process creation. Sysmon Event ID 3: Network connection to raw.githubusercontent.com. Sysmon Event ID 8: CreateRemoteThread from PowerShell to notepad.exe. PowerShell ScriptBlock Log Event ID 4104 with Invoke-DllInjection content.
- Test 3CreateRemoteThread DLL Injection via C# Executable
Expected signal: Sysmon Event ID 1: Process Create for csc.exe (C# compiler) spawned by PowerShell. Sysmon Event ID 1: injector_test.exe execution. Sysmon Event ID 11: File Create for injector_test.exe in TEMP. If full injection is performed: Sysmon Event ID 8 for CreateRemoteThread.
References (7)
- https://attack.mitre.org/techniques/T1055/001/
- https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- https://www.endgame.com/blog/technical-blog/hunting-memory
- https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
- https://www.ired.team/offensive-security/code-injection-process-injection/modulestomping-dll-hollowing-shellcode-injection
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055.001/T1055.001.md
- https://lolbas-project.github.io/lolbas/Binaries/Mavinject/
Unlock Pro Content
Get the full detection package for T1055.001 including response playbook, investigation guide, and atomic red team tests.