Detect Process Injection in Splunk
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.
MITRE ATT&CK
- Technique
- T1055 Process Injection
- Canonical reference
- https://attack.mitre.org/techniques/T1055/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=8 OR EventCode=10)
| eval is_remote_thread=if(EventCode=8, 1, 0)
| eval is_process_access=if(EventCode=10 AND (match(GrantedAccess, "0x1F[0-9A-Fa-f]{4}") OR GrantedAccess="0x1FFFFF" OR GrantedAccess="0x001F0FFF" OR GrantedAccess="0x143A"), 1, 0)
| where is_remote_thread=1 OR is_process_access=1
| eval SourceProcess=coalesce(SourceImage, Image)
| eval TargetProcess=coalesce(TargetImage, Image)
| search NOT SourceProcess IN ("*\\MsMpEng.exe", "*\\csrss.exe", "*\\services.exe", "*\\svchost.exe", "*\\lsass.exe")
| eval HighRiskTarget=if(match(TargetProcess, "(?i)(lsass|csrss|winlogon|services|svchost|explorer)\.exe$"), "Yes", "No")
| table _time, host, User, EventCode, SourceProcess, TargetProcess, GrantedAccess, HighRiskTarget
| sort - _timeDetects process injection indicators via Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) with suspicious access rights. Combines both telemetry sources for broader coverage. Filters out trusted OS processes as sources and flags high-risk target processes. Suspicious GrantedAccess values include PROCESS_ALL_ACCESS (0x1FFFFF, 0x001F0FFF) and common injection masks (0x143A = VM_READ + VM_WRITE + VM_OPERATION + CREATE_THREAD + QUERY_INFORMATION).
Data Sources
Required Sourcetypes
False Positives & Tuning
- Endpoint protection products injecting monitoring DLLs into processes
- Application compatibility shims performing legitimate injection
- Accessibility tools and screen readers injecting into GUI processes
- Development tools and debuggers attaching to processes
Other platforms for T1055
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CreateRemoteThread DLL Injection via PowerShell
Expected signal: Sysmon Event ID 1: Process Create for notepad.exe spawned by PowerShell. If using the full injection API chain, Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) will fire for the cross-process interaction.
- Test 2Process Injection via Mavinject
Expected signal: Sysmon Event ID 1: Process Create for mavinject.exe with /INJECTRUNNING argument. Sysmon Event ID 8: CreateRemoteThread from mavinject.exe to the target. Sysmon Event ID 7: ImageLoad of the injected DLL in the target process.
- Test 3Ptrace-based Process Injection on Linux
Expected signal: auditd: PTRACE syscall logged with type=SYSCALL and a]0=PTRACE_ATTACH. Syslog may show process attachment events. /proc/[pid]/status will show TracerPid set to the strace PID.
References (6)
- https://attack.mitre.org/techniques/T1055/
- https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055/T1055.md
- https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_remote_thread
Unlock Pro Content
Get the full detection package for T1055 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1055.001Dynamic-link Library Injection
- T1055.002Portable Executable Injection
- T1055.003Thread Execution Hijacking
- T1055.004Asynchronous Procedure Call
- T1055.005Thread Local Storage
- T1055.008Ptrace System Calls
- T1055.009Proc Memory
- T1055.011Extra Window Memory Injection
- T1055.012Process Hollowing
- T1055.013Process Doppelganging
- T1055.014VDSO Hijacking
- T1055.015ListPlanting