T1055Defense EvasionAdvancedDefense plan →

Process Injection: From Classic DLL to Process Hollowing and .NET Reflection

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·18 min read

A comprehensive map of Windows process injection techniques: for every technique from classic DLL injection to process hollowing, Doppelgänging, APC/Early Bird, and .NET reflective assembly loading — the API chain, Sysmon/ETW detection, and defensive triad. A technical reference for red/purple team and SOC/DFIR teams.

Exploit

Prevention

Detection

Defense profile:3 detection rules 2 mitigations 3 baseline controls 3 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Process injection (MITRE T1055) is the execution of malicious code injected into the memory space of a legitimate process; DLL injection, process hollowing, and reflective loading are the primary variants. Sysmon Event ID 8 (CreateRemoteThread) and ID 10 (ProcessAccess) are critical log sources. EDR solutions should behaviorally flag the VirtualAllocEx + WriteProcessMemory + CreateRemoteThread sequence. Because .NET-based reflective loading leaves no disk artifacts, a memory-scanning and telemetry-focused approach is mandatory.

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

ASLR Disabled Via Sysctl or Direct Syscall - Linux

Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000) - Modification of the /proc/sys/kernel/randomize_va_space file - Execution of the `sysctl` command to set `kernel.randomize_va_space=0` Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

high

sigmaExperimental

Show ruleHide rule

title: ASLR Disabled Via Sysctl or Direct Syscall - Linux
id: e497a24e-9345-4a62-9803-b06d7d7cb132
status: experimental
description: |
    Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
      - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
      - Modification of the /proc/sys/kernel/randomize_va_space file
      - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`
    Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.
    A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.
references:
    - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md
    - https://man7.org/linux/man-pages/man2/personality.2.html
    - https://manual.cs50.io/2/personality
    - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/
author: Milad Cheraghi
date: 2025-05-26
modified: 2025-12-05
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.defense-impairment
    - attack.t1685
    - attack.t1055.009
logsource:
    product: linux
    service: auditd
detection:
    selection_syscall:
        type: 'SYSCALL'
        SYSCALL: 'personality'
        a0: 40000
    selection_sysctl:
        type: 'EXECVE'
        a0: 'sysctl'
        a1: '-w'
        a2: 'kernel.randomize_va_space=0' # 0 = disable
    condition: 1 of selection_*
falsepositives:
    - Debugging or legitimate software testing
level: high

Not validated

Telemetry required to run: linux; auditdlinux / auditdlinux

False positive: Debugging or legitimate software testing

Source: SIGMA · Detection Rule License (DRL) 1.1 · original rule

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Behavior Prevention on Endpoint

Prevention

Block common attack behaviors using Defender ASR rules and Office macro restrictions.

Information note

Informational note: Behavioral prevention at the endpoint encompasses EDR and XDR capabilities beyond signature-based AV. Microsoft Defender ASR rules stop Office applications from spawning child processes, executable content from email, and PowerShell injection. ASR rules should first be deployed in audit mode to assess the false positive rate before switching to block mode.

Privileged Account Management

Prevention

Keep the number and use of privileged accounts to a minimum: Domain Admins hygiene, LAPS, JIT/PIM.

Information note

Informational note: In privileged account management, the JIT (Just-In-Time) access model eliminates the risk of persistent administrator sessions being compromised. PAM solutions provide auditability through password vaulting, session recording, and approval workflows. In cloud environments, avoiding the use of root accounts for daily operations and assigning time-limited permissions via PIM is the foundation of modern security guidance.

Baseline controls against this technique

The following security baseline controls mitigate this technique. Compare your organization's configuration against the relevant baseline by .

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

Techniques in the Defense Evasion tactic

T1562.001Defense EvasionExpert

Explains how modern EDRs use userland API hooks, kernel callbacks, and ETW telemetry; how attackers target these layers via direct/indirect syscall, NTDLL unhooking, ETW/AMSI patching, and call stack spoofing; and how defenders detect these with ETW-TI, kernel call stack analysis, and telemetry integrity monitoring. ATT&CK: T1562.001, T1106, T1027.007, T1620, T1574.013.

June 13, 202614 min read

Exploit

Prevention

Detection

References

MITRE ATT&CK — T1055: Process Injection: From Classic DLL to Process Hollowing and .NET Reflection ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

title: Suspicious CreateRemoteThread from Unusual Source Process id: 5a1d3f8b-2e6c-4b9d-8f1a-3c7e2d5b9f4e status: experimental description: | Detects process injection via CreateRemoteThread (Sysmon Event ID 8) where the source process is an unusual or suspicious executable. Legitimate remote thread creation is rare and typically limited to debuggers and security tools. Attackers use CreateRemoteThread to inject shellcode or DLLs into legitimate processes (explorer.exe, svchost.exe, etc.) to evade detection and inherit target process privileges. Office applications, scripting hosts, and browsers creating remote threads are particularly high-fidelity indicators. references: - https://attack.mitre.org/techniques/T1055/ - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_susp_source_image.yml - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/create-remote-thread.md - https://www.elastic.co/guide/en/security/current/prebuilt-rule-8-17-4-suspicious-lsass-process-access.html author: CyberSecLab (AI) date: 2026-06-13 tags: - attack.defense_evasion - attack.privilege_escalation - attack.t1055 logsource: category: create_remote_thread product: windows detection: selection_suspicious_source: SourceImage|endswith: - '\powershell.exe' - '\pwsh.exe' - '\cmd.exe' - '\mshta.exe' - '\wscript.exe' - '\cscript.exe' - '\regsvr32.exe' - '\rundll32.exe' - '\msiexec.exe' - '\winword.exe' - '\excel.exe' - '\outlook.exe' - '\powerpnt.exe' - '\msaccess.exe' - '\mspub.exe' - '\firefox.exe' - '\chrome.exe' - '\iexplore.exe' - '\notepad.exe' - '\certutil.exe' - '\bitsadmin.exe' - '\wmic.exe' filter_known_legitimate: TargetImage|endswith: - '\WerFault.exe' - '\werfault.exe' SourceImage|endswith: - '\WerFault.exe' condition: selection_suspicious_source and not filter_known_legitimate falsepositives: - Güvenlik ürünleri (EDR, AV) process enjeksiyonu simüle edebilir - Visual Studio veya diğer hata ayıklayıcılar CreateRemoteThread kullanabilir - Bazı meşru yazılımlar (örneğin ekran okuyucular) bu yöntemi kullanabilir level: high

title: Suspicious High-Privilege Process Access to LSASS or Explorer for Injection id: b9f2a4c7-3e1d-4a8b-9c5f-2d7e6b0a3f1c status: experimental description: | Detects suspicious cross-process access (Sysmon Event ID 10) to high-value target processes (lsass.exe, explorer.exe, svchost.exe, winlogon.exe) with elevated access rights typically used for process injection (0x1F0FFF, 0x1FFFFF PROCESS_ALL_ACCESS; 0x0820 for shellcode writing and thread creation). PROCESS_ALL_ACCESS on lsass is a common indicator of credential dumping combined with injection. The CallTrace field is used to filter out legitimate callers (known Windows DLLs) and highlight cases where unknown/suspicious DLLs are on the call stack. references: - https://attack.mitre.org/techniques/T1055/ - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/process-access.md - https://www.elastic.co/guide/en/security/current/prebuilt-rule-8-17-4-suspicious-lsass-process-access.html - https://www.ired.team/offensive-security/code-injection-process-injection author: CyberSecLab (AI) date: 2026-06-13 tags: - attack.defense_evasion - attack.privilege_escalation - attack.credential_access - attack.t1055 logsource: category: process_access product: windows detection: selection_target_sensitive: TargetImage|endswith: - '\lsass.exe' - '\explorer.exe' - '\winlogon.exe' - '\csrss.exe' selection_access_rights: GrantedAccess|contains: - '0x1F0FFF' - '0x1FFFFF' - '0x143A' - '0x0820' - '0x1410' filter_legitimate_tools: SourceImage|contains: - '\Windows\System32\' - '\Windows\SysWOW64\' SourceImage|endswith: - '\csrss.exe' - '\lsm.exe' - '\wmiprvse.exe' - '\taskmgr.exe' - '\procexp.exe' - '\procexp64.exe' - '\procmon.exe' - '\procmon64.exe' - '\MsMpEng.exe' - '\SenseIR.exe' filter_access_benign: GrantedAccess: - '0x1000' - '0x1400' - '0x100000' - '0x40' - '0x3200' condition: (selection_target_sensitive and selection_access_rights) and not (filter_legitimate_tools or filter_access_benign) falsepositives: - Windows Defender ve EDR ürünleri lsass.exe'ye erişim yapabilir - Process Explorer, Process Monitor gibi sistem izleme araçları - Meşru yedekleme yazılımları explorer.exe'ye erişebilir level: high

Process Injection: From Classic DLL to Process Hollowing and .NET Reflection

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

ASLR Disabled Via Sysctl or Direct Syscall - Linux

Mitigations

Behavior Prevention on Endpoint

Privileged Account Management

Baseline controls against this technique

Response playbooks

Techniques in the Defense Evasion tactic

References

Process Injection - CreateRemoteThread Suspicious Source Process

Process Injection - lsass/explorer High Privilege Process Access

Active Directory Trust and Forest Attacks: SID History, Trust Key, and Cross-Forest Escalation

Process Injection — Active C2 and Domain Compromise Response

Memory Acquisition and Volatility Triage — Process Injection Response

Process Injection Suspicion — Triage and Controlled Response