T1055 Splunk · SPL

Detect Process Injection in Splunk

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

MITRE ATT&CK

Tactic
Defense Evasion Privilege Escalation
Technique
T1055 Process Injection
Canonical reference
https://attack.mitre.org/techniques/T1055/

SPL Detection Query

Splunk (SPL)
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=8 OR EventCode=10)
| eval is_remote_thread=if(EventCode=8, 1, 0)
| eval is_process_access=if(EventCode=10 AND (match(GrantedAccess, "0x1F[0-9A-Fa-f]{4}") OR GrantedAccess="0x1FFFFF" OR GrantedAccess="0x001F0FFF" OR GrantedAccess="0x143A"), 1, 0)
| where is_remote_thread=1 OR is_process_access=1
| eval SourceProcess=coalesce(SourceImage, Image)
| eval TargetProcess=coalesce(TargetImage, Image)
| search NOT SourceProcess IN ("*\\MsMpEng.exe", "*\\csrss.exe", "*\\services.exe", "*\\svchost.exe", "*\\lsass.exe")
| eval HighRiskTarget=if(match(TargetProcess, "(?i)(lsass|csrss|winlogon|services|svchost|explorer)\.exe$"), "Yes", "No")
| table _time, host, User, EventCode, SourceProcess, TargetProcess, GrantedAccess, HighRiskTarget
| sort - _time
high severity medium confidence

Detects process injection indicators via Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) with suspicious access rights. Combines both telemetry sources for broader coverage. Filters out trusted OS processes as sources and flags high-risk target processes. Suspicious GrantedAccess values include PROCESS_ALL_ACCESS (0x1FFFFF, 0x001F0FFF) and common injection masks (0x143A = VM_READ + VM_WRITE + VM_OPERATION + CREATE_THREAD + QUERY_INFORMATION).

Data Sources

Process: Process AccessProcess: OS API ExecutionSysmon Event ID 8Sysmon Event ID 10

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • Endpoint protection products injecting monitoring DLLs into processes
  • Application compatibility shims performing legitimate injection
  • Accessibility tools and screen readers injecting into GUI processes
  • Development tools and debuggers attaching to processes

Other platforms for T1055

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 CreateRemoteThread DLL Injection via PowerShell

    Expected signal: Sysmon Event ID 1: Process Create for notepad.exe spawned by PowerShell. If using the full injection API chain, Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) will fire for the cross-process interaction.

  2. Test 2 Process Injection via Mavinject

    Expected signal: Sysmon Event ID 1: Process Create for mavinject.exe with /INJECTRUNNING argument. Sysmon Event ID 8: CreateRemoteThread from mavinject.exe to the target. Sysmon Event ID 7: ImageLoad of the injected DLL in the target process.

  3. Test 3 Ptrace-based Process Injection on Linux

    Expected signal: auditd: PTRACE syscall logged with type=SYSCALL and a]0=PTRACE_ATTACH. Syslog may show process attachment events. /proc/[pid]/status will show TracerPid set to the strace PID.

Last updated: 2026-04-16 Research depth: deep
References (6)

Response Playbook

Triage

  1. Identify the source process performing the injection — is it a known legitimate application, a LOLBin, or an unknown/unsigned binary?
  2. Identify the target process — is it a high-value target (lsass.exe, winlogon.exe, csrss.exe) or a common injection target (explorer.exe, svchost.exe)?
  3. Check the source process's digital signature — is it signed by a trusted publisher? Use sigcheck or similar tools
  4. Review the source process's parent chain — how was the injecting process launched? Trace back to the initial execution vector
  5. Check for additional injection-related API calls from the same source: VirtualAllocEx, WriteProcessMemory, NtMapViewOfSection, QueueUserAPC
  6. Look for network connections from the target process post-injection — this may indicate C2 communication through the injected process

Containment

  1. Isolate the affected endpoint immediately if injection into lsass.exe or other credential-handling processes is confirmed
  2. Kill the source (injecting) process if it is confirmed malicious — the injected code in the target may persist
  3. If the injected target is a system process, prepare for a reboot as killing it may cause system instability
  4. Block the hash of the injecting binary across the environment via EDR or application control policy
  5. If lateral movement indicators are found, isolate all affected endpoints and begin credential rotation

Evidence Collection

  1. Capture a full memory dump of both the source and target processes using tools like procdump or Volatility
  2. Collect Sysmon Event IDs 1, 7, 8, 10 for the relevant time window around the injection event
  3. Capture the injecting binary for reverse engineering and hash-based IOC extraction
  4. Review DeviceNetworkEvents or Sysmon Event ID 3 for any network activity from the target process after injection
  5. Collect the VAD (Virtual Address Descriptor) tree of the target process to identify injected memory regions with PAGE_EXECUTE_READWRITE permissions
  6. Check for loaded DLLs (Sysmon Event ID 7) in the target process that do not correspond to files on disk (reflective injection)

Escalation Criteria

  • !Any injection into lsass.exe — this strongly indicates credential theft (Mimikatz, LSASS dump)
  • !Injection from an unsigned or unknown binary into any system process
  • !Post-injection network connections to external IP addresses from the target process
  • !Multiple injection events across different endpoints within a short time window (possible worm or lateral movement tool)
  • !Injection followed by evidence of privilege escalation (new service creation, scheduled task, token manipulation)
  • !Detection of known offensive tool signatures (Cobalt Strike, Metasploit, Sliver) in the injecting binary or injected memory

Investigation Guide

Related Techniques

T1055.001 — Dynamic-link Library InjectionT1055.002 — Portable Executable InjectionT1055.003 — Thread Execution HijackingT1055.004 — Asynchronous Procedure CallT1055.012 — Process HollowingT1003 — OS Credential Dumping (common post-injection goal)T1134 — Access Token Manipulation (privilege escalation companion)T1027.011 — Fileless Storage (injected code avoids disk)

Forensic Artifacts

  • >Sysmon Event ID 8 (CreateRemoteThread) — logs source and target process details
  • >Sysmon Event ID 10 (ProcessAccess) — logs cross-process access with GrantedAccess rights
  • >Sysmon Event ID 7 (ImageLoad) — detects DLLs loaded into unexpected processes
  • >Memory: VAD entries with PAGE_EXECUTE_READWRITE in target process indicate injected executable regions
  • >Memory: Unbacked executable memory regions (not mapped to a file on disk) are strong indicators of injection
  • >ETW: Microsoft-Windows-Threat-Intelligence provider captures kernel-level injection telemetry
  • >ProcMon: WriteProcessMemory and VirtualAllocEx calls targeting remote processes

Tuning Guidance

Process injection detections are inherently noisy due to legitimate software that performs cross-process operations. Start by building a baseline of known-good injection sources in your environment — EDR agents, accessibility tools, application shims, and development tools are common sources. Create allowlists based on source process path + digital signature, never on process name alone (as names can be spoofed). For Sysmon Event ID 10, focus on suspicious GrantedAccess masks: 0x1FFFFF (PROCESS_ALL_ACCESS), 0x1F0FFF, 0x143A, and 0x1410. Filter out well-known EDR process names but validate they're loading from expected paths. Consider correlating injection events with subsequent network activity from the target to reduce false positives and increase confidence.

Hunting Queries

Hunt for processes performing multiple cross-process thread injections. A process injecting into many different targets or performing frequent injection is highly suspicious and may indicate an active C2 implant or injection framework.

Hunting — KQL
kql 
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "CreateRemoteThreadApiCall"
| summarize InjectionCount=count(), UniqueTargets=dcount(FileName), Targets=make_set(FileName) by InitiatingProcessFileName, DeviceName
| where InjectionCount > 3 or UniqueTargets > 2
| sort by InjectionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=8
| stats count as InjectionCount, dc(TargetImage) as UniqueTargets, values(TargetImage) as Targets by SourceImage, host
| where InjectionCount > 3 OR UniqueTargets > 2
| sort - InjectionCount

Hunt for injection specifically targeting critical system processes. Any CreateRemoteThread into lsass.exe, csrss.exe, winlogon.exe, or services.exe is almost certainly malicious and warrants immediate investigation.

Hunting — KQL
kql 
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "CreateRemoteThreadApiCall"
| where FileName in~ ("lsass.exe", "csrss.exe", "winlogon.exe", "services.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=8 (TargetImage="*\\lsass.exe" OR TargetImage="*\\csrss.exe" OR TargetImage="*\\winlogon.exe" OR TargetImage="*\\services.exe")
| table _time, host, User, SourceImage, TargetImage, StartFunction
| sort - _time

Hunt for system processes loading DLLs from unusual locations. Legitimate system processes like svchost.exe and explorer.exe should primarily load DLLs from System32 and Program Files. DLLs loaded from temp directories, user profiles, or other unusual paths may indicate DLL injection.

Hunting — KQL
kql 
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("svchost.exe", "explorer.exe", "notepad.exe", "calc.exe")
| where FileName !startswith "C:\\Windows\\"
| where FileName !startswith "C:\\Program Files"
| summarize UnusualDLLs=make_set(FileName), Count=count() by InitiatingProcessFileName, DeviceName
| where Count > 0
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 (Image="*\\svchost.exe" OR Image="*\\explorer.exe" OR Image="*\\notepad.exe" OR Image="*\\calc.exe") NOT (ImageLoaded="C:\\Windows\\*" OR ImageLoaded="C:\\Program Files*")
| stats values(ImageLoaded) as UnusualDLLs, count as Count by Image, host
| where Count > 0
| sort - Count

Atomic Red Team Tests

Test 1 CreateRemoteThread DLL Injection via PowerShell
windows

Uses PowerShell to call Win32 APIs (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) to inject a benign DLL path into a target process. This is the classic DLL injection pattern used by tools like Cobalt Strike, Metasploit, and many commodity malware families.

Command

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "$proc = Start-Process notepad.exe -PassThru; Start-Sleep -Seconds 2; Stop-Process -Id $proc.Id -Force"

Cleanup

powershell 
taskkill /F /IM notepad.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for notepad.exe spawned by PowerShell. If using the full injection API chain, Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) will fire for the cross-process interaction.

Expected Detection

KQL: CreateRemoteThreadApiCall action type detected. SPL: Sysmon EventCode=8 with SourceImage=powershell.exe and TargetImage=notepad.exe.

Test 2 Process Injection via Mavinject
windows

Uses the legitimate Microsoft signed binary mavinject.exe (Application Virtualization Injector) to inject a DLL into a target process. This is a LOLBAS technique that abuses a trusted Microsoft utility for injection.

Command

powershell 
notepad.exe & timeout /t 2 & mavinject.exe %PID% /INJECTRUNNING C:\Windows\System32\amsi.dll

Cleanup

powershell 
taskkill /F /IM notepad.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for mavinject.exe with /INJECTRUNNING argument. Sysmon Event ID 8: CreateRemoteThread from mavinject.exe to the target. Sysmon Event ID 7: ImageLoad of the injected DLL in the target process.

Expected Detection

Alert fires on mavinject.exe execution with /INJECTRUNNING parameter, which is a known LOLBAS injection vector.

Test 3 Ptrace-based Process Injection on Linux
linux

Uses ptrace system call to attach to a running process on Linux. Ptrace is the primary mechanism for debugger-based process injection on Linux systems. This test uses strace as a safe way to demonstrate ptrace attachment.

Command

bash 
sleep 60 & TARGETPID=$!; strace -p $TARGETPID -e trace=write -o /tmp/ptrace_test.log & STRACEPID=$!; sleep 3; kill $STRACEPID; kill $TARGETPID; rm -f /tmp/ptrace_test.log

Cleanup

bash 
rm -f /tmp/ptrace_test.log

Expected Telemetry

auditd: PTRACE syscall logged with type=SYSCALL and a]0=PTRACE_ATTACH. Syslog may show process attachment events. /proc/[pid]/status will show TracerPid set to the strace PID.

Expected Detection

Linux auditd rule for ptrace syscall fires. SPL: sourcetype=linux:audit with syscall=ptrace.

Related Detections

Tactic Hubs

TA0005 Defense Evasion TA0004 Privilege Escalation

Sub-techniques (12)

Related Techniques

T1055.001 Dynamic-link Library Injection T1055.002 Portable Executable Injection T1055.003 Thread Execution Hijacking T1055.004 Asynchronous Procedure Call T1055.012 Process Hollowing T1003 OS Credential Dumping T1134 Access Token Manipulation T1027.011 Fileless Storage

Same Tactic: Defense Evasion

Popular Detections