<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-process-injection
description: >-
  Detect and analyze process injection techniques including DLL injection, process
  hollowing, APC injection, and thread hijacking in Windows environments.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - process-injection
  - dll-injection
  - process-hollowing
  - apc-injection
  - thread-hijacking
  - defense-evasion
  - memory-forensics
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1055"]
---

# Detecting Process Injection

## Overview

Process injection is a defense evasion and privilege escalation technique where malware executes code in the address space of another process. This allows malware to evade security products, inherit process permissions, and blend with legitimate processes. Common techniques include classic DLL injection, process hollowing (RunPE), APC queue injection, thread execution hijacking, and newer techniques like process doppelgänging and transacted hollowing. Detection requires monitoring API call sequences, memory anomalies, and cross-process operations.

## Prerequisites

- Windows analysis VM with Sysmon, Procmon, and API Monitor
- Volatility3 for memory forensics
- PE-sieve / Hollows Hunter for live scanning
- x64dbg for dynamic analysis
- Python 3.10+ with `ctypes`, `pefile`
- ETW (Event Tracing for Windows) consumer tools
- Understanding of Windows process/memory architecture

## Key Concepts

### Injection Technique Matrix

| Technique | MITRE ATT&CK | Key APIs | Detection Signal |
|-----------|--------------|----------|-----------------|
| Classic DLL Injection | T1055.001 | `OpenProcess`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateRemoteThread` | Cross-process thread creation |
| Process Hollowing | T1055.012 | `CreateProcess(SUSPENDED)`, `NtUnmapViewOfSection`, `WriteProcessMemory`, `ResumeThread` | Suspended process + memory unmap |
| APC Injection | T1055.004 | `OpenThread`, `QueueUserAPC`, `NtQueueApcThread` | APC queued to remote thread |
| Thread Hijacking | T1055.003 | `SuspendThread`, `SetThreadContext`, `ResumeThread` | Thread context modification |
| Process Doppelgänging | T1055.013 | `NtCreateTransaction`, `NtCreateSection`, `NtRollbackTransaction` | NTFS transaction + rollback |
| Early Bird | T1055.004 | `CreateProcess(SUSPENDED)`, `QueueUserAPC`, `ResumeThread` | APC before main thread runs |
| Atom Bombing | T1055 | `GlobalAddAtom`, `QueueUserAPC(NtSetContextThread)` | Atom table abuse |

### Memory Anomaly Indicators

- **RWX regions**: Memory allocated with `PAGE_EXECUTE_READWRITE` is suspicious
- **Unbacked executable memory**: Executable memory not mapped to a file on disk
- **Hollowed sections**: PE headers in memory don't match disk image
- **Injected threads**: Thread start address points to unbacked memory

## Workflow

### Step 1: Sysmon-Based Detection

```xml
<!-- Sysmon config for injection detection -->
<RuleGroup groupRelation="or">
  <!-- Event ID 8: CreateRemoteThread -->
  <CreateRemoteThread onmatch="exclude">
    <!-- Exclude known legitimate cases -->
    <SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
  </CreateRemoteThread>

  <!-- Event ID 10: Process Access with injection-relevant rights -->
  <ProcessAccess onmatch="include">
    <GrantedAccess condition="is">0x1F0FFF</GrantedAccess> <!-- PROCESS_ALL_ACCESS -->
    <GrantedAccess condition="is">0x1FFFFF</GrantedAccess>
    <GrantedAccess condition="is">0x0800</GrantedAccess>    <!-- PROCESS_CREATE_THREAD -->
    <GrantedAccess condition="is">0x001F0FFF</GrantedAccess>
  </ProcessAccess>
</RuleGroup>
```

### Step 2: Sigma Detection Rules

```yaml
title: Process Injection via CreateRemoteThread
id: b2c5e3f8-4a1d-4e9b-8c7f-d1e2f3a4b5c6
status: experimental
description: Detects cross-process thread creation indicative of DLL injection
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    EventID: 8
  filter_legitimate:
    SourceImage|endswith:
      - '\csrss.exe'
      - '\lsass.exe'
      - '\services.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Debugging tools (Visual Studio, WinDbg)
  - Some security products that inject into processes
level: high
tags:
  - attack.t1055.001
  - attack.defense_evasion
```

```yaml
title: Process Hollowing - Suspended Process with Memory Write
id: d4e5f6a7-b8c9-0a1b-2c3d-e4f5a6b7c8d9
status: experimental
description: Detects process created suspended followed by memory manipulation
logsource:
  product: windows
  service: sysmon
detection:
  process_create:
    EventID: 1
    CommandLine|contains: ' /suspended'
  mem_access:
    EventID: 10
    GrantedAccess|contains:
      - '0x20'
      - '0x1F0FFF'
  condition: process_create | mem_access
falsepositives:
  - .NET JIT compilation creates suspended processes
level: medium
tags:
  - attack.t1055.012
  - attack.defense_evasion
```

### Step 3: Memory Forensics with Volatility3

```bash
# Detect injected code in processes
vol3 -f memory.dmp windows.malfind

# List processes with parent relationships
vol3 -f memory.dmp windows.pstree

# Scan for injected DLLs
vol3 -f memory.dmp windows.dlllist --pid 1234

# Detect hollowed processes (VAD analysis)
vol3 -f memory.dmp windows.vadinfo --pid 1234

# Extract injected code
vol3 -f memory.dmp windows.malfind --pid 1234 --dump
```

### Step 4: Live Detection with PE-sieve

```bash
# Scan specific process
pe-sieve.exe /pid 1234 /shellc /iat 2 /data 2 /minidmp

# Scan all processes
hollows_hunter.exe /iat 2 /shellc /dir output_dir

# Output interpretation:
# - replaced: process hollowing detected
# - implanted_pe: injected PE detected
# - implanted_shc: injected shellcode detected
# - unreachable_file: backing file mismatch
```

### Step 5: API Monitor Analysis

```python
#!/usr/bin/env python3
"""Detect injection API call sequences from API Monitor logs."""
import re

INJECTION_SEQUENCES = {
    "classic_dll_injection": [
        "OpenProcess", "VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread"
    ],
    "process_hollowing": [
        "CreateProcessA|CreateProcessW", "NtUnmapViewOfSection",
        "VirtualAllocEx", "WriteProcessMemory", "SetThreadContext", "ResumeThread"
    ],
    "apc_injection": [
        "OpenProcess", "VirtualAllocEx", "WriteProcessMemory", "QueueUserAPC"
    ],
    "early_bird": [
        "CreateProcessA|CreateProcessW", "VirtualAllocEx",
        "WriteProcessMemory", "QueueUserAPC", "ResumeThread"
    ],
}

def detect_injection_pattern(api_calls: list[str]) -> list[str]:
    """Match API call sequences against known injection patterns."""
    detections = []
    for technique, pattern in INJECTION_SEQUENCES.items():
        pattern_idx = 0
        for call in api_calls:
            if re.match(pattern[pattern_idx], call):
                pattern_idx += 1
                if pattern_idx == len(pattern):
                    detections.append(technique)
                    break
    return detections
```

## Verification

- [ ] Injection technique identified (type and variant)
- [ ] Source and target processes documented
- [ ] Injected code/DLL extracted for analysis
- [ ] API call sequence captured and correlated
- [ ] Memory artifacts preserved (dumps, VAD data)
- [ ] Detection rules written (Sysmon + Sigma + YARA)
- [ ] MITRE ATT&CK TTP mapped

## References

- [MITRE ATT&CK T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/)
- [PE-sieve - Process Scanner](https://github.com/hasherezade/pe-sieve)
- [Volatility3 Framework](https://github.com/volatilityfoundation/volatility3)
- [Elastic - Ten Process Injection Techniques](https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process)
- [Red Team Notes - Process Injection](https://www.ired.team/offensive-security/code-injection-process-injection)
