T1055 — Process Injection

# T1055 - Process Injection

## SOC Recommendation
Investigate Process Injection activity in the context of Stealth/Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. where InitiatingProcessFileName in~ ("w3wp.exe","httpd.exe","nginx.exe","php-cgi.exe","java.exe")
2. where FileName in~ ("cmd.exe","powershell.exe","sh","bash","whoami.exe","net.exe","ipconfig.exe","id")
3. project Timestamp, FileName, ProcessCommandLine, AccountName, SHA256
4. order by Timestamp asc

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Take web server offline — isolate immediately | Medium | No | Yes |
| Delete the web shell file | Low | No | Yes |
| Preserve the file and logs as forensic evidence before delet | Low | No | Yes |
| Audit all commands executed via the web shell | Low | No | Yes |
| Rotate all credentials accessible from the web server | Medium | No | Yes |
| Full forensic review before returning server to service | Low | Yes | No |

## KQL
```kql
let SuspiciousSources = dynamic([
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "wscript.exe",
    "cscript.exe",
    "mshta.exe",
    "rundll32.exe",
    "regsvr32.exe",
    "msiexec.exe",
    "installutil.exe"
]);
let HighValueTargets = dynamic([
    "lsass.exe",
    "svchost.exe",
    "explorer.exe",
    "winlogon.exe",
    "csrss.exe",
    "taskhost.exe",
    "taskhostw.exe",
    "dllhost.exe",
    "mmc.exe",
    "searchindexer.exe"
]);
DeviceEvents
| where TimeGenerated >= ago(5m)
| where ActionType in ("CreateRemoteThread", "WriteProcessMemory", "ProcessInjection")
| where InitiatingProcessFileName in~ (SuspiciousSources)
| where FileName in~ (HighValueTargets)
| project
    TimeGenerated,
    DeviceName,
    DeviceId,
    AccountName,
    AccountDomain,
    ActionType,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessSHA256,
    FileName,
    AdditionalFields
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
(union isfuzzy=true
(Event
| where Source == "Microsoft-Windows-Sysmon"
| where EventID in (17,18)
| where EventData has '583da945-62af-10e8-4902-a8f205c72b2e'
| extend EventData = parse_xml(EventData).DataItem.EventData.Data
| mv-expand bagexpansion=array EventData
| evaluate bag_unpack(EventData)
| extend Key = tostring(column_ifexists('@Name', "")), Value = column_ifexists('#text', "")
| evaluate pivot(Key, any(Value), TimeGenerated, Source, EventLog, Computer, EventLevel, EventLevelName, EventID, UserName, MG, ManagementGroupName, _ResourceId)
| extend PipeName = column_ifexists("PipeName", "")
| extend Account = User
| extend AccountName = tostring(split(User, @"\")[1]), AccountNTDomain = tostring(split(User, @"\")[0])
),
(
SecurityEvent
| where EventID == '5145'
// %%4418 looks for presence of CreatePipeInstance value
| where AccessList has '%%4418'
| where RelativeTargetName has '583da945-62af-10e8-4902-a8f205c72b2e'
| extend AccountName = SubjectUserName, AccountNTDomain = SubjectDomainName
),
(
WindowsEvent
| where EventID == '5145' and EventData has '%%4418'  and EventData has '583da945-62af-10e8-4902-a8f205c72b2e'
// %%4418 looks for presence of CreatePipeInstance value
| extend AccessList= tostring(EventData.AccessList)
| where AccessList has '%%4418'
| extend RelativeTargetName= tostring(EventData.RelativeTargetName)
| where RelativeTargetName has '583da945-62af-10e8-4902-a8f205c72b2e'
| extend Account =  strcat(tostring(EventData.SubjectDomainName),"\\", tostring(EventData.SubjectUserName))
| extend AccountName = tostring(EventData.SubjectUserName), AccountNTDomain = tostring(EventData.SubjectDomainName)
)
)
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| project-away DomainIndex
```
```kql
ContrastADRAttackEvents_CL
| where result =~ "exploited"
```

## Escalation Criteria
- Process Injection activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1055.json
• /api/recommendations/T1055.json
• /api/d3fend/T1055.json
• /api/mappings/T1055.json
• /api/confluence/T1055.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1055.json

Response:

{
  "technique_id": "T1055",
  "name": "Process Injection",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Stealth",
    "Privilege Escalation"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges...",
  "soc_recommendation": "Investigate Process Injection activity in the context of Stealth/Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "where InitiatingProcessFileName in~ (\"w3wp.exe\",\"httpd.exe\",\"nginx.exe\",\"php-cgi.exe\",\"java.exe\")",
      "where FileName in~ (\"cmd.exe\",\"powershell.exe\",\"sh\",\"bash\",\"whoami.exe\",\"net.exe\",\"ipconfig.exe\",\"id\")",
      "project Timestamp, FileName, ProcessCommandLine, AccountName, SHA256",
      "order by Timestamp asc"
    ],
    "generic": [
      "Confirm whether the observed process injection activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Process Injection\" -- Detects suspicious remote thread creation and related injection activity into high-value processes."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Take web server offline — isolate immediately",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Delete the web shell file",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Preserve the file and logs as forensic evidence before delet",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Preserve the file and logs as forensic evidence before deletion"
    },
    {
      "name": "Audit all commands executed via the web shell",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Rotate all credentials accessible from the web server",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Full forensic review before returning server to service",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-PE-003 — Process Injection",
        "description": "Detects suspicious remote thread creation and related injection activity into high-value processes. (Source: Bell Integration baseline detection library.)",
        "query": "let SuspiciousSources = dynamic([\n    \"cmd.exe\",\n    \"powershell.exe\",\n    \"pwsh.exe\",\n    \"wscript.exe\",\n    \"cscript.exe\",\n    \"mshta.exe\",\n    \"rundll32.exe\",\n    \"regsvr32.exe\",\n    \"msiexec.exe\",\n    \"installutil.exe\"\n]);\nlet HighValueTargets = dynamic([\n    \"lsass.exe\",\n    \"svchost.exe\",\n    \"explorer.exe\",\n    \"winlogon.exe\",\n    \"csrss.exe\",\n    \"taskhost.exe\",\n    \"taskhostw.exe\",\n    \"dllhost.exe\",\n    \"mmc.exe\",\n    \"searchindexer.exe\"\n]);\nDeviceEvents\n| where TimeGenerated >= ago(5m)\n| where ActionType in (\"CreateRemoteThread\", \"WriteProcessMemory\", \"ProcessInjection\")\n| where InitiatingProcessFileName in~ (SuspiciousSources)\n| where FileName in~ (HighValueTargets)\n| project\n    TimeGenerated,\n    DeviceName,\n    DeviceId,\n    AccountName,\n    AccountDomain,\n    ActionType,\n    InitiatingProcessFileName,\n    InitiatingProcessCommandLine,\n    InitiatingProcessSHA256,\n    FileName,\n    AdditionalFields\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "11b4c19d-2a79-4da3-af38-b067e1273dee — Solorigate Named Pipe",
        "description": "Identifies a match across various data feeds for named pipe IOCs related to the Solorigate incident. For the sysmon events required for this detection, logging for Named Pipe Events needs to be configured in Sysmon config (Event ID 17 and Event ID 18) Reference: https://techcommunity.microsoft.com/t5/azure-sentinel/solarwinds-post-compromise-hunting-with-azure-sentinel/ba-p/1995095' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "(union isfuzzy=true\n(Event\n| where Source == \"Microsoft-Windows-Sysmon\"\n| where EventID in (17,18)\n| where EventData has '583da945-62af-10e8-4902-a8f205c72b2e'\n| extend EventData = parse_xml(EventData).DataItem.EventData.Data\n| mv-expand bagexpansion=array EventData\n| evaluate bag_unpack(EventData)\n| extend Key = tostring(column_ifexists('@Name', \"\")), Value = column_ifexists('#text', \"\")\n| evaluate pivot(Key, any(Value), TimeGenerated, Source, EventLog, Computer, EventLevel, EventLevelName, EventID, UserName, MG, ManagementGroupName, _ResourceId)\n| extend PipeName = column_ifexists(\"PipeName\", \"\")\n| extend Account = User\n| extend AccountName = tostring(split(User, @\"\\\")[1]), AccountNTDomain = tostring(split(User, @\"\\\")[0])\n),\n(\nSecurityEvent\n| where EventID == '5145'\n// %%4418 looks for presence of CreatePipeInstance value\n| where AccessList has '%%4418'\n| where RelativeTargetName has '583da945-62af-10e8-4902-a8f205c72b2e'\n| extend AccountName = SubjectUserName, AccountNTDomain = SubjectDomainName\n),\n(\nWindowsEvent\n| where EventID == '5145' and EventData has '%%4418'  and EventData has '583da945-62af-10e8-4902-a8f205c72b2e'\n// %%4418 looks for presence of CreatePipeInstance value\n| extend AccessList= tostring(EventData.AccessList)\n| where AccessList has '%%4418'\n| extend RelativeTargetName= tostring(EventData.RelativeTargetName)\n| where RelativeTargetName has '583da945-62af-10e8-4902-a8f205c72b2e'\n| extend Account =  strcat(tostring(EventData.SubjectDomainName),\"\\\\\", tostring(EventData.SubjectUserName))\n| extend AccountName = tostring(EventData.SubjectUserName), AccountNTDomain = tostring(EventData.SubjectDomainName)\n)\n)\n| extend HostName = tostring(split(Computer, \".\")[0]), DomainIndex = toint(indexof(Computer, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)\n| project-away DomainIndex"
      },
      {
        "name": "ae4f67a6-0713-4a26-ae61-284e67b408c1 — Contrast ADR - Exploited Attack Event",
        "description": "Detects successful exploitation of security vulnerabilities across all environments as identified by Contrast ADR. This rule captures confirmed exploited attacks that bypassed application security controls and require security team investigation.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "ContrastADRAttackEvents_CL\n| where result =~ \"exploited\""
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "acf738b5-b5b2-4acc-bad9-1e18ee234f40 — Suspicious Managed Code Hosting Process",
        "description": "(EQL) Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n  file.name : (\"wscript.exe.log\",\n               \"cscript.exe.log\",\n               \"mshta.exe.log\",\n               \"wmic.exe.log\",\n               \"svchost.exe.log\",\n               \"dllhost.exe.log\",\n               \"cmstp.exe.log\",\n               \"regsvr32.exe.log\")"
      },
      {
        "name": "2dd480be-1263-4d9c-8672-172928f6789a — Suspicious Process Access via Direct System Call",
        "description": "(EQL) Identifies suspicious process access events from an unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"windows\" and event.code == \"10\" and\n length(winlog.event_data.CallTrace) > 0 and\n\n /* Sysmon CallTrace starting with unknown memory module instead of ntdll which host Windows NT Syscalls */\n not winlog.event_data.CallTrace :\n            (\"?:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll*\",\n             \"?:\\\\WINDOWS\\\\SysWOW64\\\\ntdll.dll*\",\n             \"?:\\\\Windows\\\\System32\\\\sysfer.dll*\",\n             \"?:\\\\Windows\\\\System32\\\\wow64cpu.dll*\",\n             \"?:\\\\WINDOWS\\\\System32\\\\wow64win.dll*\",\n             \"?:\\\\Windows\\\\System32\\\\win32u.dll*\",\n             \"?:\\\\ProgramData\\\\Symantec\\\\Symantec Endpoint Protection\\\\*\\\\sysfer.dll*\") and\n\n not winlog.event_data.TargetImage :\n            (\"?:\\\\Program Files (x86)\\\\Malwarebytes Anti-Exploit\\\\mbae-svc.exe\",\n             \"?:\\\\Program Files\\\\Cisco\\\\AMP\\\\*\\\\sfc.exe\",\n             \"?:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\*\\\\msedgewebview2.exe\",\n             \"?:\\\\Program Files\\\\Adobe\\\\Acrobat DC\\\\Acrobat\\\\*\\\\AcroCEF.exe\") and\n\n not (process.executable : (\"?:\\\\Program Files\\\\Adobe\\\\Acrobat DC\\\\Acrobat\\\\Acrobat.exe\",\n                            \"?:\\\\Program Files (x86)\\\\World of Warcraft\\\\_classic_\\\\WowClassic.exe\") and\n      not winlog.event_data.TargetImage : \"?:\\\\WINDOWS\\\\system32\\\\lsass.exe\")"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Process Injection activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1055 - Process Injection Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}