T1055 CrowdStrike LogScale · LogScale

Detect Process Injection in CrowdStrike LogScale

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

MITRE ATT&CK

Tactic
Defense Evasion Privilege Escalation
Technique
T1055 Process Injection
Canonical reference
https://attack.mitre.org/techniques/T1055/

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
(#event_simpleName = "CreateRemoteThread" OR #event_simpleName = "ProcessInjection" OR #event_simpleName = "InjectionCode")
| SourceFileName != /(?i)(MsMpEng|csrss|services|svchost|lsass|wmiprvse)\.exe/
| TargetFileName = /(?i)(lsass|csrss|winlogon|services|svchost|explorer|spoolsv)\.exe/
| HighRiskTarget := "Yes"
| sort(field=@timestamp, order=desc, limit=500)
| table(@timestamp, ComputerName, UserSid, SourceFileName, SourceCommandLine, TargetFileName, HighRiskTarget)
high severity medium confidence

CrowdStrike LogScale query detecting process injection attempts via Falcon sensor telemetry. Matches CreateRemoteThread, ProcessInjection, and InjectionCode event types from untrusted source processes targeting high-value Windows system processes. Requires CrowdStrike Falcon EDR with process injection telemetry enabled and logs forwarded to LogScale. Event names may vary by Falcon sensor version; adjust #event_simpleName values to match your sensor telemetry schema.

Data Sources

CrowdStrike Falcon EDRCrowdStrike LogScale (Humio)

Required Tables

Falcon Sensor Telemetry

False Positives & Tuning

  • CrowdStrike Falcon sensor's own prevention and detection hooks generating self-referential injection telemetry during active threat response and process hollowing prevention
  • Java Runtime Environment and .NET CLR creating threads across process boundaries during JIT compilation, class loading, or managed garbage collection cycles
  • Microsoft Office COM automation and add-in frameworks injecting code into Word, Excel, or Outlook process space for legitimate document processing and macro execution
  • Automated UI testing frameworks (Selenium WebDriver, WinAppDriver, Ranorex) injecting JavaScript or driver hooks into browser and application processes for test orchestration

Other platforms for T1055

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 CreateRemoteThread DLL Injection via PowerShell

    Expected signal: Sysmon Event ID 1: Process Create for notepad.exe spawned by PowerShell. If using the full injection API chain, Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) will fire for the cross-process interaction.

  2. Test 2 Process Injection via Mavinject

    Expected signal: Sysmon Event ID 1: Process Create for mavinject.exe with /INJECTRUNNING argument. Sysmon Event ID 8: CreateRemoteThread from mavinject.exe to the target. Sysmon Event ID 7: ImageLoad of the injected DLL in the target process.

  3. Test 3 Ptrace-based Process Injection on Linux

    Expected signal: auditd: PTRACE syscall logged with type=SYSCALL and a]0=PTRACE_ATTACH. Syslog may show process attachment events. /proc/[pid]/status will show TracerPid set to the strace PID.

Last updated: 2026-04-16 Research depth: deep
References (6)

Response Playbook

Triage

  1. Identify the source process performing the injection — is it a known legitimate application, a LOLBin, or an unknown/unsigned binary?
  2. Identify the target process — is it a high-value target (lsass.exe, winlogon.exe, csrss.exe) or a common injection target (explorer.exe, svchost.exe)?
  3. Check the source process's digital signature — is it signed by a trusted publisher? Use sigcheck or similar tools
  4. Review the source process's parent chain — how was the injecting process launched? Trace back to the initial execution vector
  5. Check for additional injection-related API calls from the same source: VirtualAllocEx, WriteProcessMemory, NtMapViewOfSection, QueueUserAPC
  6. Look for network connections from the target process post-injection — this may indicate C2 communication through the injected process

Containment

  1. Isolate the affected endpoint immediately if injection into lsass.exe or other credential-handling processes is confirmed
  2. Kill the source (injecting) process if it is confirmed malicious — the injected code in the target may persist
  3. If the injected target is a system process, prepare for a reboot as killing it may cause system instability
  4. Block the hash of the injecting binary across the environment via EDR or application control policy
  5. If lateral movement indicators are found, isolate all affected endpoints and begin credential rotation

Evidence Collection

  1. Capture a full memory dump of both the source and target processes using tools like procdump or Volatility
  2. Collect Sysmon Event IDs 1, 7, 8, 10 for the relevant time window around the injection event
  3. Capture the injecting binary for reverse engineering and hash-based IOC extraction
  4. Review DeviceNetworkEvents or Sysmon Event ID 3 for any network activity from the target process after injection
  5. Collect the VAD (Virtual Address Descriptor) tree of the target process to identify injected memory regions with PAGE_EXECUTE_READWRITE permissions
  6. Check for loaded DLLs (Sysmon Event ID 7) in the target process that do not correspond to files on disk (reflective injection)

Escalation Criteria

  • !Any injection into lsass.exe — this strongly indicates credential theft (Mimikatz, LSASS dump)
  • !Injection from an unsigned or unknown binary into any system process
  • !Post-injection network connections to external IP addresses from the target process
  • !Multiple injection events across different endpoints within a short time window (possible worm or lateral movement tool)
  • !Injection followed by evidence of privilege escalation (new service creation, scheduled task, token manipulation)
  • !Detection of known offensive tool signatures (Cobalt Strike, Metasploit, Sliver) in the injecting binary or injected memory

Investigation Guide

Related Techniques

T1055.001 — Dynamic-link Library InjectionT1055.002 — Portable Executable InjectionT1055.003 — Thread Execution HijackingT1055.004 — Asynchronous Procedure CallT1055.012 — Process HollowingT1003 — OS Credential Dumping (common post-injection goal)T1134 — Access Token Manipulation (privilege escalation companion)T1027.011 — Fileless Storage (injected code avoids disk)

Forensic Artifacts

  • >Sysmon Event ID 8 (CreateRemoteThread) — logs source and target process details
  • >Sysmon Event ID 10 (ProcessAccess) — logs cross-process access with GrantedAccess rights
  • >Sysmon Event ID 7 (ImageLoad) — detects DLLs loaded into unexpected processes
  • >Memory: VAD entries with PAGE_EXECUTE_READWRITE in target process indicate injected executable regions
  • >Memory: Unbacked executable memory regions (not mapped to a file on disk) are strong indicators of injection
  • >ETW: Microsoft-Windows-Threat-Intelligence provider captures kernel-level injection telemetry
  • >ProcMon: WriteProcessMemory and VirtualAllocEx calls targeting remote processes

Tuning Guidance

Process injection detections are inherently noisy due to legitimate software that performs cross-process operations. Start by building a baseline of known-good injection sources in your environment — EDR agents, accessibility tools, application shims, and development tools are common sources. Create allowlists based on source process path + digital signature, never on process name alone (as names can be spoofed). For Sysmon Event ID 10, focus on suspicious GrantedAccess masks: 0x1FFFFF (PROCESS_ALL_ACCESS), 0x1F0FFF, 0x143A, and 0x1410. Filter out well-known EDR process names but validate they're loading from expected paths. Consider correlating injection events with subsequent network activity from the target to reduce false positives and increase confidence.

Hunting Queries

Hunt for processes performing multiple cross-process thread injections. A process injecting into many different targets or performing frequent injection is highly suspicious and may indicate an active C2 implant or injection framework.

Hunting — KQL
kql 
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "CreateRemoteThreadApiCall"
| summarize InjectionCount=count(), UniqueTargets=dcount(FileName), Targets=make_set(FileName) by InitiatingProcessFileName, DeviceName
| where InjectionCount > 3 or UniqueTargets > 2
| sort by InjectionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=8
| stats count as InjectionCount, dc(TargetImage) as UniqueTargets, values(TargetImage) as Targets by SourceImage, host
| where InjectionCount > 3 OR UniqueTargets > 2
| sort - InjectionCount

Hunt for injection specifically targeting critical system processes. Any CreateRemoteThread into lsass.exe, csrss.exe, winlogon.exe, or services.exe is almost certainly malicious and warrants immediate investigation.

Hunting — KQL
kql 
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "CreateRemoteThreadApiCall"
| where FileName in~ ("lsass.exe", "csrss.exe", "winlogon.exe", "services.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=8 (TargetImage="*\\lsass.exe" OR TargetImage="*\\csrss.exe" OR TargetImage="*\\winlogon.exe" OR TargetImage="*\\services.exe")
| table _time, host, User, SourceImage, TargetImage, StartFunction
| sort - _time

Hunt for system processes loading DLLs from unusual locations. Legitimate system processes like svchost.exe and explorer.exe should primarily load DLLs from System32 and Program Files. DLLs loaded from temp directories, user profiles, or other unusual paths may indicate DLL injection.

Hunting — KQL
kql 
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("svchost.exe", "explorer.exe", "notepad.exe", "calc.exe")
| where FileName !startswith "C:\\Windows\\"
| where FileName !startswith "C:\\Program Files"
| summarize UnusualDLLs=make_set(FileName), Count=count() by InitiatingProcessFileName, DeviceName
| where Count > 0
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 (Image="*\\svchost.exe" OR Image="*\\explorer.exe" OR Image="*\\notepad.exe" OR Image="*\\calc.exe") NOT (ImageLoaded="C:\\Windows\\*" OR ImageLoaded="C:\\Program Files*")
| stats values(ImageLoaded) as UnusualDLLs, count as Count by Image, host
| where Count > 0
| sort - Count

Atomic Red Team Tests

Test 1 CreateRemoteThread DLL Injection via PowerShell
windows

Uses PowerShell to call Win32 APIs (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) to inject a benign DLL path into a target process. This is the classic DLL injection pattern used by tools like Cobalt Strike, Metasploit, and many commodity malware families.

Command

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "$proc = Start-Process notepad.exe -PassThru; Start-Sleep -Seconds 2; Stop-Process -Id $proc.Id -Force"

Cleanup

powershell 
taskkill /F /IM notepad.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for notepad.exe spawned by PowerShell. If using the full injection API chain, Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) will fire for the cross-process interaction.

Expected Detection

KQL: CreateRemoteThreadApiCall action type detected. SPL: Sysmon EventCode=8 with SourceImage=powershell.exe and TargetImage=notepad.exe.

Test 2 Process Injection via Mavinject
windows

Uses the legitimate Microsoft signed binary mavinject.exe (Application Virtualization Injector) to inject a DLL into a target process. This is a LOLBAS technique that abuses a trusted Microsoft utility for injection.

Command

powershell 
notepad.exe & timeout /t 2 & mavinject.exe %PID% /INJECTRUNNING C:\Windows\System32\amsi.dll

Cleanup

powershell 
taskkill /F /IM notepad.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for mavinject.exe with /INJECTRUNNING argument. Sysmon Event ID 8: CreateRemoteThread from mavinject.exe to the target. Sysmon Event ID 7: ImageLoad of the injected DLL in the target process.

Expected Detection

Alert fires on mavinject.exe execution with /INJECTRUNNING parameter, which is a known LOLBAS injection vector.

Test 3 Ptrace-based Process Injection on Linux
linux

Uses ptrace system call to attach to a running process on Linux. Ptrace is the primary mechanism for debugger-based process injection on Linux systems. This test uses strace as a safe way to demonstrate ptrace attachment.

Command

bash 
sleep 60 & TARGETPID=$!; strace -p $TARGETPID -e trace=write -o /tmp/ptrace_test.log & STRACEPID=$!; sleep 3; kill $STRACEPID; kill $TARGETPID; rm -f /tmp/ptrace_test.log

Cleanup

bash 
rm -f /tmp/ptrace_test.log

Expected Telemetry

auditd: PTRACE syscall logged with type=SYSCALL and a]0=PTRACE_ATTACH. Syslog may show process attachment events. /proc/[pid]/status will show TracerPid set to the strace PID.

Expected Detection

Linux auditd rule for ptrace syscall fires. SPL: sourcetype=linux:audit with syscall=ptrace.

Related Detections

Tactic Hubs

TA0005 Defense Evasion TA0004 Privilege Escalation

Sub-techniques (12)

Related Techniques

T1055.001 Dynamic-link Library Injection T1055.002 Portable Executable Injection T1055.003 Thread Execution Hijacking T1055.004 Asynchronous Procedure Call T1055.012 Process Hollowing T1003 OS Credential Dumping T1134 Access Token Manipulation T1027.011 Fileless Storage

Same Tactic: Defense Evasion

Popular Detections