Process Injection T1055

Events covered

29 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 125 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (49 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (759 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (329 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 49 rules

• APT PRIVATELOG Image Load Pattern
• CobaltStrike Named Pipe
• CobaltStrike Named Pipe Pattern Regex
• CobaltStrike Named Pipe Patterns
• Created Files by Microsoft Sync Center
• CreateRemoteThread API and LoadLibrary
• Dllhost.EXE Execution Anomaly
• DotNet CLR DLL Loaded By Scripting Applications
• HackTool - CACTUSTORCH Remote Thread Creation
• HackTool - CoercedPotato Execution
• HackTool - CoercedPotato Named Pipe Creation
• HackTool - DInjector PowerShell Cradle Execution
• HackTool - EfsPotato Named Pipe Creation
• HackTool - HollowReaper Execution
• HackTool - LittleCorporal Generated Maldoc Injection
• HackTool - Potential CobaltStrike Process Injection
• Injected Browser Process Spawning Rundll32 - GuLoader Activity
• Lummac Stealer Activity - Execution Of More.com And Vbc.exe
• Malicious Named Pipe Created
• Malware Shellcode in Verclsid Target Process
• ManageEngine Endpoint Central Dctask64.EXE Potential Abuse
• Mavinject Inject DLL Into Running Process
• Microsoft Sync Center Suspicious Network Connections
• Network Connection Initiated Via Notepad.EXE
• Potential DLL Injection Or Execution Using Tracker.exe
• Potential DLL Sideloading Using Coregen.exe
• Potential Dridex Activity
• Potential Executable Run Itself As Sacrificial Process
• Potential Pikabot Hollowing Activity
• Potential Process Hollowing Activity
• Potential Process Injection Via Msra.EXE
• Potential Shellcode Injection
• PowerShell ShellCode
• Process Creation Using Sysnative Folder
• Rare Remote Thread Creation By Uncommon Source Image
• RedSun - Named Pipe Created
• RedSun - TieringEngineService.exe Detected as EICAR Test File
• Remote Thread Created In Shell Application
• Remote Thread Creation By Uncommon Source Image
• Remote Thread Creation In Uncommon Target Image
• Renamed Mavinject.EXE Execution
• Renamed ZOHO Dctask64 Execution
• Suspect Svchost Activity
• Suspicious Child Process Of Wermgr.EXE
• Suspicious Rundll32 Invoking Inline VBScript
• Suspicious Userinit Child Process
• TAIDOOR RAT DLL Load
• Uncommon Process Access Rights For Target Image
• Uncommon Svchost Command Line Parameter

Elastic 12 rules

• Conhost Spawned By Suspicious Parent Process
• Potential Process Injection from Malicious Document
• Process Injection by the Microsoft Build Engine
• Suspicious Communication App Child Process
• Suspicious Endpoint Security Parent Process
• Suspicious Outlook Child Process
• Suspicious Process Access via Direct System Call
• Suspicious Process Creation CallTrace
• Suspicious Zoom Child Process
• Unusual Child Process from a System Virtual Process
• Unusual Parent-Child Relationship
• Unusual Service Host Child Process - Childless Service

Splunk 58 rules

• Create Remote Thread In Shell Application
• DLLHost with no Command Line Arguments with Network
• GPUpdate with no Command Line Arguments with Network
• Known Process Injection Commands (PowerShell)
• Known Process Injection Commands (Sysmon)
• Known Process Injection Commands (Windows Event Log)
• Loading Of Dynwrapx Module
• Mavinject Execution (EDR)
• Mavinject Execution (Sysmon)
• Mavinject Execution (Windows Event Log)
• Named Pipe Created (Sysmon)
• Notepad with no Command Line Arguments
• Potential CVE-2023-23397 (EDR)
• Potential CVE-2023-23397 (Sysmon)
• Potential CVE-2023-23397 (Windows Event Log)
• Powershell DLL_EXE Injection (PowerShell)
• Powershell Fileless Process Injection via GetProcAddress
• PowerShell PInvoke Process Injection API Chain
• Powershell Remote Thread To Known Windows Process
• Process Executed with Null Command Line (Sysmon)
• Process Executed with Null Command Line (Windows Event Log)
• Rare Remote Thread (Sysmon)
• Remote Thread Created by Uncommon Process (Sysmon)
• Remote Thread from Suspicious Folder (Sysmon)
• Rundll32 Create Remote Thread To A Process
• Rundll32 CreateRemoteThread In Browser
• SearchProtocolHost with no Command Line with Network
• Suspicious Child Process for lsass.exe (Sysmon)
• Suspicious Child Process for lsass.exe (Windows Event Log)
• Suspicious DLLHost no Command Line Arguments
• Suspicious GPUpdate no Command Line Arguments
• Suspicious Parent Process for lsass.exe or services.exe (Sysmon)
• Suspicious Parent Process for lsass.exe or services.exe (Windows Event Log)
• Suspicious Parent Process for spoolsv.exe (Sysmon)
• Suspicious Parent Process for spoolsv.exe (Windows Event Log)
• Suspicious SearchProtocolHost no Command Line Arguments
• Trickbot Named Pipe
• Unexpected Network Connection from System Process (Sysmon)
• Unexpected Network Connection from System Process (Windows Event Log)
• Unusual svchost Child Process (Sysmon)
• Unusual svchost Child Process (Windows Event Log)
• Windows List ENV Variables Via SET Command From Uncommon Parent
• Windows Process Injection In Non-Service SearchIndexer
• Windows Process Injection into Commonly Abused Processes
• Windows Process Injection into Notepad
• Windows Process Injection Of Wermgr to Known Browser
• Windows Process Injection Remote Thread
• Windows Process Injection Wermgr Child Process
• Windows Process Injection With Public Source Path
• Windows Process With NamedPipe CommandLine
• Windows PUA Named Pipe
• Windows Rasautou DLL Execution
• Windows Remote Assistance Spawning Process
• Windows RMM Named Pipe
• Windows Suspicious C2 Named Pipe
• Windows Suspicious Named Pipe
• Winhlp32 Spawning a Process
• Wscript Or Cscript Suspicious Child Process

Kusto 6 rules

• ADWS Connection from Process Injection Target
• Powershell Empire Cmdlets Executed in Command Line
• Process Injection From Untrusted Process
• Process Injection Initiated By MMC
• Solorigate Named Pipe
• Suspicious named pipes