MITRE ATT&CKtechnique

T1055 Process Injection

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Stealth, Privilege Escalation
Platforms
Linux, macOS, Windows
Version
2.0
Created
2017-05-31

Description

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Related

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1040 Behavior Prevention on Endpoint mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · subtechnique of (12)

  • T1055.015 ListPlanting sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1055.002 Portable Executable Injection sub-technique
  • T1055.003 Thread Execution Hijacking sub-technique
  • T1055.004 Asynchronous Procedure Call sub-technique
  • T1055.005 Thread Local Storage sub-technique
  • T1055.008 Ptrace System Calls sub-technique
  • T1055.009 Proc Memory sub-technique
  • T1055.011 Extra Window Memory Injection sub-technique
  • T1055.012 Process Hollowing sub-technique
  • T1055.013 Process Doppelgänging sub-technique
  • T1055.014 VDSO Hijacking sub-technique

Referenced by MITRE ATT&CK · uses (88)

  • S9050 Vidar software (malware)
  • S9020 LODEINFO software (malware)
  • S9021 DOWNIISSA software (malware)
  • S9023 HiddenFace software (malware)
  • S9025 NOOPLDR software (malware)
  • S9019 PureCrypter software (malware)
  • C0057 3CX Supply Chain Attack campaign
  • C0056 RedPenguin campaign
  • G1047 Velvet Ant group
  • C0046 ArcaneDoor campaign
  • S1181 BlackByte 2.0 Ransomware software (malware)
  • G1043 BlackByte group
  • S1159 DUSTTRAP software (malware)
  • S1122 Mispadu software (malware)
  • C0029 Cutting Edge campaign
  • S1105 COATHANGER software (malware)
  • G1023 APT5 group
  • S1100 Ninja software (malware)
  • C0028 2015 Ukraine Electric Power Attack campaign
  • G1018 TA2541 group
  • S1081 BADHATCH software (malware)
  • S1074 ANDROMEDA software (malware)
  • S1065 Woody RAT software (malware)
  • S1059 metaMain software (malware)
  • S1050 PcShare software (tool)
  • C0014 Operation Wocao campaign
  • C0013 Operation Sharpshooter campaign
  • S1039 Bumblebee software (malware)
  • S0695 Donut software (tool)
  • S0692 SILENTTRINITY software (tool)
Show all 88 ›

Referenced by CAPEC · att&ck technique (2)

  • CAPEC-251 Local Code Inclusion attack pattern
  • CAPEC-660 Root/Jailbreak Detection Evasion via Hooking attack pattern

Referenced by Compliance · mitigates (15)

  • CIS-10.1 Deploy and Maintain Anti-Malware Software CIS Safeguard v8.1
  • CIS-10.7 Use Behavior-Based Anti-Malware Software CIS Safeguard v8.1
  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SC-18 Mobile Code NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control