Detect Portable Executable Injection in IBM QRadar
Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). Unlike DLL injection, PE injection copies the entire executable image into the target process rather than loading a DLL via LoadLibrary. The displacement of the injected code introduces the additional requirement for functionality to remap memory references.
MITRE ATT&CK
- Technique
- T1055 Process Injection
- Sub-technique
- T1055.002 Portable Executable Injection
- Canonical reference
- https://attack.mitre.org/techniques/T1055/002/
QRadar Detection Query
SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
LOGSOURCENAME(logsourceid) AS LogSource,
CATEGORYNAME(category) AS Category,
sourceip AS SourceIP,
username AS User,
"SourceImage" AS InjectorProcess,
"TargetImage" AS TargetProcess,
"StartModule" AS StartModule,
"StartAddress" AS StartAddress,
"StartFunction" AS StartFunction
FROM events
WHERE LOGSOURCENAME(logsourceid) ILIKE '%sysmon%'
AND QIDNAME(qid) LIKE '%CreateRemoteThread%'
AND ("StartModule" IS NULL OR "StartModule" = '')
AND "SourceImage" NOT ILIKE '%MsMpEng.exe'
AND "SourceImage" NOT ILIKE '%csrss.exe'
AND "SourceImage" NOT ILIKE '%services.exe'
AND "SourceImage" NOT ILIKE '%svchost.exe'
AND "SourceImage" NOT ILIKE '%lsass.exe'
AND "SourceImage" NOT ILIKE '%wmiprvse.exe'
ORDER BY starttime DESC
LAST 24 HOURSIBM QRadar AQL query detecting PE injection via Sysmon CreateRemoteThread events where the StartModule custom property is null or empty. Relies on a Sysmon DSM (built-in or custom) that parses SourceImage, TargetImage, StartModule, StartAddress, and StartFunction as QRadar custom event properties. Filter LOGSOURCENAME ILIKE '%sysmon%' scopes to Sysmon log sources; adjust to match your environment's log source naming convention.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate endpoint security products performing injection-based API hooking may create remote threads without populating StartModule in the parsed DSM output
- JIT compilers and managed runtimes (.NET CLR, Java JVM) that create threads via NtCreateThreadEx in the host process space without a module path
- Software DRM and copy-protection systems (e.g., Denuvo) that spawn enforcement threads in protected application processes without a discoverable module reference
Other platforms for T1055.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PE Injection via PowerShell with VirtualAllocEx and WriteProcessMemory
Expected signal: Sysmon Event ID 1: notepad.exe spawned by PowerShell. If full API chain used: Sysmon Event ID 10 (ProcessAccess) from PowerShell to notepad.exe with PROCESS_VM_WRITE rights. Sysmon Event ID 8 if CreateRemoteThread is called.
- Test 2Shellcode Injection via Donut Framework
Expected signal: When using the full Donut injection: Sysmon Event ID 8 (CreateRemoteThread) with empty StartModule. Sysmon Event ID 10 (ProcessAccess) with PROCESS_ALL_ACCESS. No corresponding Sysmon Event ID 7 (ImageLoad) in the target process.
- Test 3Process Injection using C# System.Diagnostics APIs
Expected signal: Sysmon Event ID 1: csc.exe spawned by PowerShell (compilation). Sysmon Event ID 11: pe_inject_test.exe created in TEMP. Sysmon Event ID 1: pe_inject_test.exe execution. Sysmon Event ID 1: notepad.exe spawned by pe_inject_test.exe.
References (5)
- https://attack.mitre.org/techniques/T1055/002/
- https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055.002/T1055.002.md
- https://github.com/TheWover/donut
- https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
Unlock Pro Content
Get the full detection package for T1055.002 including response playbook, investigation guide, and atomic red team tests.