Common Information
Type Value
Value
Process Injection - T1055
Category Attack-Pattern
Type Mitre-Enterprise-Attack-Attack-Pattern
Misp Type Cluster
Description Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. ===Windows=== There are multiple approaches to injecting code into a live process. Windows implementations include: (Citation: Engame Process Injection July 2017) * '''Dynamic-link library (DLL) injection''' involves writing the path to a malicious DLL inside a process then invoking execution by creating a remote thread. * '''Portable executable injection''' involves writing malicious code directly into the process (without a file on disk) then invoking execution with either additional code or by creating a remote thread. The displacement of the injected code introduces the additional requirement for functionality to remap memory references. Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue. (Citation: Endgame HuntingNMemory June 2017) * '''Thread execution hijacking''' involves injecting malicious code or the path to a DLL into a thread of a process. Similar to Process Hollowing, the thread must first be suspended. * '''Asynchronous Procedure Call''' (APC) injection involves attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state. AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is a variation that utilizes APCs to invoke malicious code previously written to the global atom table. (Citation: Microsoft Atom Table) * '''Thread Local Storage''' (TLS) callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. (Citation: FireEye TLS Nov 2017) ===Mac and Linux=== Implementations for Linux and OS X/macOS systems include: (Citation: Datawire Code Injection) (Citation: Uninformed Needle) *'''LD_PRELOAD, LD_LIBRARY_PATH''' (Linux), '''DYLD_INSERT_LIBRARIES''' (Mac OS X) environment variables, or the dlfcn application programming interface (API) can be used to dynamically load a library (shared object) in a process which can be used to intercept API calls from the running process. (Citation: Phrack halfdead 1997) *'''Ptrace system calls''' can be used to attach to a running process and modify it in runtime. (Citation: Uninformed Needle) *'''/proc/[pid]/mem''' provides access to the memory of the process and can be used to read/write arbitrary data to it. This technique is very rare due to its complexity. (Citation: Uninformed Needle) *'''VDSO hijacking''' performs runtime injection on ELF binaries by manipulating code stubs mapped in from the linux-vdso.so shared object. (Citation: VDSO hijack 2009) Malware commonly utilizes process injection to access system resources through which Persistence and other environment modifications can be made. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. Detection: Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. API calls such as CreateRemoteThread, SuspendThread/SetThreadContext/ResumeThread, QueueUserAPC, and those that can be used to modify memory within another process, such as WriteProcessMemory, may be used for this technique. (Citation: Engame Process Injection July 2017) Monitoring for Linux specific calls such as the ptrace system call, the use of LD_PRELOAD environment variable, or dlfcn dynamic linking API calls, should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods. (Citation: ArtOfMemoryForensics) (Citation: GNU Acct) (Citation: RHEL auditd) (Citation: Chokepoint preload rootkits) Monitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules. (Citation: Microsoft Sysmon v6 May 2017) Monitor processes and command-line arguments for actions that could be done before or after code injection has occurred and correlate the information with related event information. Code injection may also be performed using PowerShell with tools such as PowerSploit, (Citation: Powersploit) so additional PowerShell monitoring may be required to cover known implementations of this behavior. Platforms: Linux, macOS, Windows Data Sources: API monitoring, Windows Registry, File monitoring, DLL monitoring, Named Pipes, Process Monitoring Effective Permissions: User, Administrator, SYSTEM, root Defense Bypassed: Process whitelisting, Anti-virus Permissions Required: User, Administrator, SYSTEM, root Contributors: Anastasios Pingios
Details Published Attributes CTI Title
Details Website 2024-03-15 45 Malware analysis report: Smoke Loader
Details Website 2024-03-13 41 CVE-2024-21412: DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign
Details Website 2024-03-13 37 CVE-2024-21412: DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign
Details Website 2024-03-07 14 Analysing Windows Malware on Apple Mac M1/M2 ( Windows 11 ARM ) - Part II • Raashid Bhat
Details Website 2024-02-26 94 SEO Poisoning to Domain Control: The Gootloader Saga Continues
Details Website 2024-02-20 137 Earth Preta Campaign Uses DOPLUGS to Target Asia
Details Website 2024-02-04 30 Pony | Fareit
Details Website 2024-01-26 2 CylanceENDPOINT Prevents Pool Party Process Injection
Details Website 2024-01-25 74 Mosquito the new Infostealer arrives to Mexico - Metabase Q
Details Website 2024-01-01 48 Netscaler Exploitation to Social Engineering: Mapping Convergence of Adversary Tradecraft Across Victims | Huntress
Details Website 2024-01-01 81 CUCKOO SPEAR Part 2: Threat Actor Arsenal
Details Website 2023-12-11 55 Analyzing AsyncRAT's Code Injection into Aspnet_Compiler.exe Across Multiple Incident Response Cases
Details Website 2023-12-08 5 Risky Biz News: UK summons Russian ambassador over hacking campaigns, doxes FSB unit behind APT group
Details Website 2023-12-06 198 Russia/Ukraine Update - December 2023
Details Website 2023-12-04 74 SQL Brute Force Leads to BlueSky Ransomware
Details Website 2023-11-12 11 PikaBot Is Back With a Vengeance
Details Website 2023-11-09 7 Memory scanning leaves attackers nowhere to hide
Details Website 2023-11-09 19 Visual Examples of Code Injection - SANS Internet Storm Center
Details Website 2023-11-08 5 Dvenom - Tool That Provides An Encryption Wrapper And Loader For Your Shellcode - RedPacket Security
Details Website 2023-11-06 47 D0nut encrypt me, I have a wife and no backups 
Details Website 2023-11-03 19 Unmasking AsyncRAT New Infection Chain | McAfee Blog
Details Website 2023-10-31 17 Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)
Details Website 2023-10-30 22 Scattered Ransomware Attribution Blurs Focus on IR Fundamentals
Details Website 2023-10-27 7 What Is MITRE D3FEND Matrix?
Details Website 2023-10-24 7 Formbook | Malware Trends Tracker