Detecting T1055 Process Injection With Sysmon

Detecting T1055 Process Injection with Sysmon

When to Use

• When hunting for defense evasion techniques that hide malicious code inside legitimate processes
• After EDR alerts for suspicious cross-process memory access or remote thread creation
• When investigating malware that injects into svchost.exe, explorer.exe, or other system processes
• During purple team exercises testing detection of process injection variants
• When validating Sysmon configuration coverage for injection detection

Detection Gaps & Validation

• EID 8 only catches CreateRemoteThread: thread-hijacking (T1055.003, SetThreadContext), APC/early-bird injection (T1055.004, QueueUserAPC), and ListPlanting (T1055.015) never call CreateRemoteThread — lean on EID 10 ProcessAccess (0x0008|0x0020|0x0002) and memory scanners for these.
• Reflective / module-stomping loads write code without an EID 7 ImageLoaded from disk, so DLL-path rules miss them — pe-sieve/Moneta memory scans are the fallback.
• EID 25 ProcessTampering needs Sysmon 13+ and only covers hollowing-style image divergence; doppelgänging (T1055.013) via NTFS transactions evades it.
• StartAddress in unbacked memory: EID 8 with a StartFunction/StartAddress not mapping to a named module is high-signal — but only if your Sysmon config does not filter EID 8 (many shipped configs do).
• Validate: run Atomic Red Team T1055.001 (CreateRemoteThread DLL inject) and T1055.002 and confirm EID 8/10 plus the SourceImage!=TargetImage searches fire against a target like notepad.exe.
• Tune FPs: AV/EDR, debuggers, RMM agents, and accessibility tools perform legitimate cross-process writes — exclude by signed SourceImage; never exclude by target (attackers pick common targets).

Prerequisites

• Sysmon deployed with comprehensive configuration capturing Events 1, 7, 8, 10, 25
• Event ID 8 (CreateRemoteThread) enabled for remote thread detection
• Event ID 10 (ProcessAccess) configured with appropriate access mask filters
• Event ID 7 (ImageLoaded) for DLL injection detection
• Event ID 25 (ProcessTampering) for process hollowing on Sysmon 13+
• SIEM platform for correlation and alerting

Workflow

1. Monitor CreateRemoteThread (Event 8): Detect when one process creates a thread in another process's address space. This is the primary indicator of classic DLL injection and shellcode injection.
2. Analyze ProcessAccess (Event 10): Track cross-process handle requests with PROCESS_VM_WRITE (0x0020), PROCESS_VM_OPERATION (0x0008), and PROCESS_CREATE_THREAD (0x0002) access rights. Legitimate processes rarely need these on other processes.
3. Detect Anomalous DLL Loading (Event 7): Identify DLLs loaded from unusual paths (user temp directories, download folders) into system processes.
4. Hunt Process Hollowing (Event 25): Sysmon 13+ generates ProcessTampering events when the executable image in memory diverges from what was mapped from disk -- a hallmark of process hollowing (T1055.012).
5. Correlate with Process Creation: Link injection events to the originating process creation (Event 1) to build the full attack chain from initial execution to injection.
6. Filter Known-Good Cross-Process Activity: Exclude legitimate software that performs cross-process operations (debuggers, AV products, accessibility tools, RMM agents).
7. Map to ATT&CK Sub-Techniques: Classify detected injection as classic injection (T1055.001), PE injection (T1055.002), thread execution hijacking (T1055.003), APC injection (T1055.004), thread local storage (T1055.005), process hollowing (T1055.012), or process doppelganging (T1055.013).

Key Concepts

Tools & Systems

Detection Queries

Splunk -- Remote Thread Creation

index=sysmon EventCode=8
| where SourceImage!=TargetImage
| where NOT match(SourceImage, "(?i)(csrss|lsass|services|svchost|MsMpEng|SecurityHealthService|vmtoolsd)\.exe$")
| eval suspicious=if(match(TargetImage, "(?i)(svchost|explorer|lsass|winlogon|csrss|services)\.exe$"), "high_value_target", "normal_target")
| where suspicious="high_value_target"
| table _time Computer SourceImage SourceProcessId TargetImage TargetProcessId StartFunction NewThreadId

Splunk -- Suspicious ProcessAccess Patterns

index=sysmon EventCode=10
| where SourceImage!=TargetImage
| where match(GrantedAccess, "(0x1FFFFF|0x1F3FFF|0x143A|0x0040)")
| where match(TargetImage, "(?i)(lsass|svchost|explorer|winlogon)\.exe$")
| where NOT match(SourceImage, "(?i)(MsMpEng|csrss|services|svchost|taskmgr|procexp)\.exe$")
| table _time Computer SourceImage TargetImage GrantedAccess CallTrace

KQL -- Process Injection via Remote Thread

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "CreateRemoteThreadApiCall"
| where InitiatingProcessFileName !in~ ("csrss.exe", "lsass.exe", "services.exe", "svchost.exe")
| where FileName in~ ("svchost.exe", "explorer.exe", "lsass.exe", "winlogon.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine

Sigma Rule -- Process Injection Detection

title: Process Injection via CreateRemoteThread into System Process
status: stable
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\lsass.exe'
            - '\winlogon.exe'
    filter_legitimate:
        SourceImage|endswith:
            - '\csrss.exe'
            - '\lsass.exe'
            - '\services.exe'
            - '\MsMpEng.exe'
    condition: selection and not filter_legitimate
level: high
tags:
    - attack.defense_evasion
    - attack.t1055

Common Scenarios

1. Classic DLL Injection: Malware uses VirtualAllocEx + WriteProcessMemory + CreateRemoteThread to load a malicious DLL into a target process. Detected via Sysmon Event 8.
2. Process Hollowing (RunPE): Attacker creates a suspended process, unmaps its image, writes malicious PE, and resumes execution. Detected via Sysmon Event 25.
3. APC Injection: Malware queues an Asynchronous Procedure Call to threads of a target process using QueueUserAPC. Harder to detect, requires Event 10 monitoring.
4. Reflective DLL Injection: DLL is loaded directly from memory without touching disk, bypassing ImageLoaded detection. Requires memory-level analysis.
5. Process Doppelganging: Leverages NTFS transactions to replace a legitimate process image. Detected via process integrity checking.

Output Format

Hunt ID: TH-INJECT-[DATE]-[SEQ]
Host: [Hostname]
Source Process: [Injecting process path]
Source PID: [Process ID]
Target Process: [Target process path]
Target PID: [Process ID]
Injection Type: [DLL/Shellcode/Hollowing/APC]
Sysmon Events: [Event IDs triggered]
Access Mask: [Granted access value]
Risk Level: [Critical/High/Medium/Low]
ATT&CK Sub-Technique: [T1055.xxx]