Process Injection Suspicion — Triage and Controlled Response
Executes evidence-first triage, memory acquisition, classification, and controlled eradication for a single process injection suspicion detected via Sysmon EID 8/10/25 or PowerShell Script Block Logging; designed for scenarios with no active C2 evidence.
Prepare
5 steps- Sysmon telemetry validation
Periodically verify that EID 8 (CreateRemoteThread), EID 10 (ProcessAccess), EID 25 (ProcessTampering), and EID 7 (ImageLoad) events are forwarded to SIEM; and that PowerShell Script Block Logging (EID 4104) and the ETW Threat-Intelligence provider are enabled
- Detection rule deployment status
Confirm that the GrantedAccess OR-set (0x1fffff, 0x1f0fff, 0x143a, 0x1438, 0x1040), StartAddress out-of-module alerts, and EID 25 correlation rules are actually deployed and calibrated; this playbook depends on live rules
- Memory scanning tools readiness
Verify that `pe-sieve.exe` and `Moneta64.exe` (or EDR native memory scanning), `WinPMem`, and the live response kit are tested and accessible; some enterprise EDRs include native memory scanning and may not require separate tools
- Escalation chain
Document the SOC L1 → IR Lead → System Owner → CISO chain; the host isolation decision cannot be made by L1 alone
- Pre-define decision gate
If active C2/lateral movement evidence exists, abandon this playbook and switch to the Active C2 / Compromise playbook (PB-B); otherwise remain in this playbook