<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Process Injection Detection — API Reference

## PE-sieve

### Installation
Download from: https://github.com/hasherezade/pe-sieve/releases

### Commands

```bash
pe-sieve.exe /pid <PID>          # Basic scan
pe-sieve.exe /pid <PID> /shellc  # Include shellcode detection
pe-sieve.exe /pid <PID> /iat 2   # Full IAT scan
pe-sieve.exe /pid <PID> /data 2  # Full data scan
pe-sieve.exe /pid <PID> /minidmp # Create minidump
pe-sieve.exe /pid <PID> /dir <output_dir>
```

### Output Types
| Tag | Meaning |
|-----|---------|
| `replaced` | Process hollowing detected |
| `implanted_pe` | Injected PE module |
| `implanted_shc` | Injected shellcode |
| `unreachable_file` | Backing file mismatch |
| `patched` | Module code modified |

## Hollows Hunter

```bash
hollows_hunter.exe              # Scan all processes
hollows_hunter.exe /iat 2       # Full IAT scan
hollows_hunter.exe /shellc      # Shellcode detection
hollows_hunter.exe /dir <dir>   # Output directory
hollows_hunter.exe /loop        # Continuous scanning
```

## Volatility3 Commands

```bash
# Detect injected code (malfind)
vol3 -f dump.dmp windows.malfind
vol3 -f dump.dmp windows.malfind --pid 1234 --dump

# Process tree
vol3 -f dump.dmp windows.pstree

# DLL listing
vol3 -f dump.dmp windows.dlllist --pid 1234

# VAD (Virtual Address Descriptor) info
vol3 -f dump.dmp windows.vadinfo --pid 1234

# Handle listing
vol3 -f dump.dmp windows.handles --pid 1234
```

### Malfind Output Interpretation
- **Protection: PAGE_EXECUTE_READWRITE** — Suspicious RWX memory
- **MZ header in VAD** — Injected PE without corresponding DLL entry
- **Shellcode patterns** — Executable code in non-image VADs

## Sysmon Events for Injection

| Event ID | Event | Relevance |
|----------|-------|-----------|
| 1 | Process Create | Suspended process detection |
| 8 | CreateRemoteThread | DLL injection, APC injection |
| 10 | Process Access | Cross-process memory operations |
| 25 | Process Tampering | Image modification detection |

### Key Access Rights (Event ID 10)

| Value | Right | Injection Use |
|-------|-------|--------------|
| `0x0800` | PROCESS_CREATE_THREAD | CreateRemoteThread |
| `0x0020` | PROCESS_VM_WRITE | WriteProcessMemory |
| `0x0008` | PROCESS_VM_OPERATION | VirtualAllocEx |
| `0x001F0FFF` | PROCESS_ALL_ACCESS | Full injection capability |

## Windows API Sequence Patterns

### Classic DLL Injection
```
OpenProcess(PROCESS_ALL_ACCESS) →
VirtualAllocEx(MEM_COMMIT, PAGE_READWRITE) →
WriteProcessMemory(dll_path) →
CreateRemoteThread(LoadLibraryA)
```

### Process Hollowing
```
CreateProcess(CREATE_SUSPENDED) →
NtUnmapViewOfSection(target_base) →
VirtualAllocEx(new_base) →
WriteProcessMemory(malicious_PE) →
SetThreadContext(new_entry_point) →
ResumeThread()
```
