T1055: Process Injection

Description

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific.

More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Platforms

Sub-Techniques (12)

Mitigations (2)

Threat Groups (15)

ID	Group	Context
G0082	APT38	[APT38](https://attack.mitre.org/groups/G0082) has injected malicious payloads into the `explorer.exe` process.(Citation: 1 - appv)
G1043	BlackByte	[BlackByte](https://attack.mitre.org/groups/G1043) has injected [Cobalt Strike](https://attack.mitre.org/software/S0154) into `wuauclt.exe` during int...
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has used Win7Elevate to inject malicious code into explorer.exe.(Citation: Securelist Kimsuky Sept 20...
G0096	APT41	[APT41](https://attack.mitre.org/groups/G0096) malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.(Cit...
G0050	APT32	[APT32](https://attack.mitre.org/groups/G0050) malware has injected a Cobalt Strike beacon into Rundll32.exe.(Citation: Cybereason Cobalt Kitty 2017)
G0047	Gamaredon Group	[Gamaredon Group](https://attack.mitre.org/groups/G0047) has injected [Remcos](https://attack.mitre.org/software/S0332) into explorer.exe.(Citation: V...
G1018	TA2541	[TA2541](https://attack.mitre.org/groups/G1018) has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe...
G0067	APT37	[APT37](https://attack.mitre.org/groups/G0067) injects its malware variant, [ROKRAT](https://attack.mitre.org/software/S0240), into the cmd.exe proces...
G0010	Turla	[Turla](https://attack.mitre.org/groups/G0010) has also used [PowerSploit](https://attack.mitre.org/software/S0194)'s <code>Invoke-ReflectivePEInjecti...
G1023	APT5	[APT5](https://attack.mitre.org/groups/G1023) has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its func...
G0091	Silence	[Silence](https://attack.mitre.org/groups/G0091) has injected a DLL library containing a Trojan into the fwmain32.exe process.(Citation: Group IB Sile...
G0080	Cobalt Group	[Cobalt Group](https://attack.mitre.org/groups/G0080) has injected code into trusted processes.(Citation: Group IB Cobalt Aug 2017)
G0102	Wizard Spider	[Wizard Spider](https://attack.mitre.org/groups/G0102) has used process injection to execute payloads to escalate privileges.(Citation: Mandiant FIN12...
G1047	Velvet Ant	[Velvet Ant](https://attack.mitre.org/groups/G1047) initial execution included launching multiple `svchost` processes and injecting code into them.(Ci...
G0068	PLATINUM	[PLATINUM](https://attack.mitre.org/groups/G0068) has used various methods of process injection including hot patching.(Citation: Microsoft PLATINUM A...

Associated Software (65)

ID	Name	Type	Context
S0266	TrickBot	Malware	[TrickBot](https://attack.mitre.org/software/S0266) has used <code>Nt*</code> [Native API](https://attack.mitre.org/techniques/T1106) functions to inj...
S1100	Ninja	Malware	[Ninja](https://attack.mitre.org/software/S1100) has the ability to inject an agent module into a new process and arbitrary shellcode into running pro...
S0206	Wiarp	Malware	[Wiarp](https://attack.mitre.org/software/S0206) creates a backdoor through which remote attackers can inject files into running processes.(Citation: ...
S1039	Bumblebee	Malware	[Bumblebee](https://attack.mitre.org/software/S1039) can inject code into multiple processes on infected endpoints.(Citation: Cybereason Bumblebee Aug...
S0093	Backdoor.Oldrea	Malware	[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) injects itself into explorer.exe.(Citation: Symantec Dragonfly)(Citation: Gigamon Berserk B...
S1105	COATHANGER	Malware	[COATHANGER](https://attack.mitre.org/software/S1105) includes a binary labeled `authd` that can inject a library into a running process and then hook...
S0226	Smoke Loader	Malware	[Smoke Loader](https://attack.mitre.org/software/S0226) injects into the Internet Explorer process.(Citation: Talos Smoke Loader July 2018)
S0347	AuditCred	Malware	[AuditCred](https://attack.mitre.org/software/S0347) can inject code from files to other running processes.(Citation: TrendMicro Lazarus Nov 2018)
S0198	NETWIRE	Malware	[NETWIRE](https://attack.mitre.org/software/S0198) can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.(Citation: Re...
S1159	DUSTTRAP	Malware	[DUSTTRAP](https://attack.mitre.org/software/S1159) compromises the `.text` section of a legitimate system DLL in `%windir%` to hold the contents of r...
S1081	BADHATCH	Malware	[BADHATCH](https://attack.mitre.org/software/S1081) can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.(Citation: ...
S0473	Avenger	Malware	[Avenger](https://attack.mitre.org/software/S0473) has the ability to inject shellcode into svchost.exe.(Citation: Trend Micro Tick November 2019)
S1065	Woody RAT	Malware	[Woody RAT](https://attack.mitre.org/software/S1065) can inject code into a targeted process by writing to the remote memory of an infected system and...
S1181	BlackByte 2.0 Ransomware	Malware	[BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) injects into a newly-created `svchost.exe` process prior to device encryption.(Cit...
S0376	HOPLIGHT	Malware	[HOPLIGHT](https://attack.mitre.org/software/S0376) has injected into running processes.(Citation: US-CERT HOPLIGHT Apr 2019)
S0561	GuLoader	Malware	[GuLoader](https://attack.mitre.org/software/S0561) has the ability to inject shellcode into a donor processes that is started in a suspended state. [...
S0260	InvisiMole	Malware	[InvisiMole](https://attack.mitre.org/software/S0260) can inject itself into another process to avoid detection including use of a technique called Li...
S1122	Mispadu	Malware	[Mispadu](https://attack.mitre.org/software/S1122)'s binary is injected into memory via `WriteProcessMemory`.(Citation: Segurança Informática URSA Sop...
S0247	NavRAT	Malware	[NavRAT](https://attack.mitre.org/software/S0247) copies itself into a running Internet Explorer process to evade detection.(Citation: Talos NavRAT Ma...
S0614	CostaBricks	Malware	[CostaBricks](https://attack.mitre.org/software/S0614) can inject a payload into the memory of a compromised host.(Citation: BlackBerry CostaRicto Nov...

Related CWE Weaknesses

Frequently Asked Questions

What is T1055 (Process Injection)?

T1055 is a MITRE ATT&CK technique named 'Process Injection'. It belongs to the Stealth, Privilege Escalation tactic(s). Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address spa...

How can T1055 be detected?

Detection of T1055 (Process Injection) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1055?

There are 2 documented mitigations for T1055. Key mitigations include: Behavior Prevention on Endpoint, Privileged Account Management.

Which threat groups use T1055?

Known threat groups using T1055 include: APT38, BlackByte, Kimsuky, APT41, APT32, Gamaredon Group, TA2541, APT37.