What it does. Detect process injection techniques (T1055) - including DLL injection, process Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/detecting-t1055-process-injection-with-sysmon/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-t1055-process-injection-with-sysmon, or copy the skill folder into ~/.claude/skills/detecting-t1055-process-injection-with-sysmon/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1055-process-injection-with-sysmon/SKILL.md

SKILL.md (verbatim)

name: detecting-t1055-process-injection-with-sysmon
description: Detect process injection techniques (T1055) - including DLL injection, process
  hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for
  cross-process memory operations, remote thread creation, and anomalous DLL loads. Use
  when hunting defense-evasion activity that hides code inside legitimate processes, investigating
  an EDR alert on suspicious cross-process access, or validating Sysmon coverage for injection
  detection.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- process-injection
- sysmon
- mitre-t1055
- defense-evasion
- dll-injection
- process-hollowing
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Content Format Conversion
- File Content Analysis
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1055.001
- T1055.002
- T1055.003
- T1055.012

Detecting T1055 Process Injection with Sysmon

When to Use

• When hunting for defense evasion techniques that hide malicious code inside legitimate processes
• After EDR alerts for suspicious cross-process memory access or remote thread creation
• When investigating malware that injects into svchost.exe, explorer.exe, or other system processes
• During purple team exercises testing detection of process injection variants
• When validating Sysmon configuration coverage for injection detection

Prerequisites

• Sysmon deployed with comprehensive configuration capturing Events 1, 7, 8, 10, 25
• Event ID 8 (CreateRemoteThread) enabled for remote thread detection
• Event ID 10 (ProcessAccess) configured with appropriate access mask filters
• Event ID 7 (ImageLoaded) for DLL injection detection
• Event ID 25 (ProcessTampering) for process hollowing on Sysmon 13+
• SIEM platform for correlation and alerting

Workflow

1. Monitor CreateRemoteThread (Event 8): Detect when one process creates a thread in another process's address space. This is the primary indicator of classic DLL injection and shellcode injection.
2. Analyze ProcessAccess (Event 10): Track cross-process handle requests with PROCESS_VM_WRITE (0x0020), PROCESS_VM_OPERATION (0x0008), and PROCESS_CREATE_THREAD (0x0002) access rights. Legitimate processes rarely need these on other processes.
3. Detect Anomalous DLL Loading (Event 7): Identify DLLs loaded from unusual paths (user temp directories, download folders) into system processes.
4. Hunt Process Hollowing (Event 25): Sysmon 13+ generates ProcessTampering events when the executable image in memory diverges from what was mapped from disk -- a hallmark of process hollowing (T1055.012).
5. Correlate with Process Creation: Link injection events to the originating process creation (Event 1) to build the full attack chain from initial execution to injection.
6. Filter Known-Good Cross-Process Activity: Exclude legitimate software that performs cross-process operations (debuggers, AV products, accessibility tools, RMM agents).
7. Map to ATT&CK Sub-Techniques: Classify detected injection as classic injection (T1055.001), PE injection (T1055.002), thread execution hijacking (T1055.003), APC injection (T1055.004), thread local storage (T1055.005), process hollowing (T1055.012), or process doppelganging (T1055.013).

Key Concepts

Concept	Description
T1055.001	Dynamic-link Library Injection
T1055.002	Portable Executable Injection
T1055.003	Thread Execution Hijacking
T1055.004	Asynchronous Procedure Call (APC) Injection
T1055.005	Thread Local Storage
T1055.012	Process Hollowing
T1055.013	Process Doppelganging
T1055.015	ListPlanting
Sysmon Event 8	CreateRemoteThread detected
Sysmon Event 10	ProcessAccess with memory write permissions
Sysmon Event 25	ProcessTampering (image mismatch)
Access Mask 0x1FFFFF	PROCESS_ALL_ACCESS -- full cross-process control

Tools & Systems

Tool	Purpose
Sysmon	Primary telemetry source for injection detection
Process Hacker	Manual investigation of process memory regions
PE-sieve	Scan running processes for hollowed/injected code
Moneta	Detect anomalous memory regions in processes
Splunk / Elastic	SIEM correlation of Sysmon events
Volatility	Memory forensics for injection artifacts
Hollows Hunter	Automated scan for hollowed processes

Detection Queries

Splunk -- Remote Thread Creation

index=sysmon EventCode=8
| where SourceImage!=TargetImage
| where NOT match(SourceImage, "(?i)(csrss|lsass|services|svchost|MsMpEng|SecurityHealthService|vmtoolsd)\.exe$")
| eval suspicious=if(match(TargetImage, "(?i)(svchost|explorer|lsass|winlogon|csrss|services)\.exe$"), "high_value_target", "normal_target")
| where suspicious="high_value_target"
| table _time Computer SourceImage SourceProcessId TargetImage TargetProcessId StartFunction NewThreadId

Splunk -- Suspicious ProcessAccess Patterns

index=sysmon EventCode=10
| where SourceImage!=TargetImage
| where match(GrantedAccess, "(0x1FFFFF|0x1F3FFF|0x143A|0x0040)")
| where match(TargetImage, "(?i)(lsass|svchost|explorer|winlogon)\.exe$")
| where NOT match(SourceImage, "(?i)(MsMpEng|csrss|services|svchost|taskmgr|procexp)\.exe$")
| table _time Computer SourceImage TargetImage GrantedAccess CallTrace

KQL -- Process Injection via Remote Thread

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "CreateRemoteThreadApiCall"
| where InitiatingProcessFileName !in~ ("csrss.exe", "lsass.exe", "services.exe", "svchost.exe")
| where FileName in~ ("svchost.exe", "explorer.exe", "lsass.exe", "winlogon.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine

Sigma Rule -- Process Injection Detection

title: Process Injection via CreateRemoteThread into System Process
status: stable
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\lsass.exe'
            - '\winlogon.exe'
    filter_legitimate:
        SourceImage|endswith:
            - '\csrss.exe'
            - '\lsass.exe'
            - '\services.exe'
            - '\MsMpEng.exe'
    condition: selection and not filter_legitimate
level: high
tags:
    - attack.defense_evasion
    - attack.t1055

Common Scenarios

1. Classic DLL Injection: Malware uses VirtualAllocEx + WriteProcessMemory + CreateRemoteThread to load a malicious DLL into a target process. Detected via Sysmon Event 8.
2. Process Hollowing (RunPE): Attacker creates a suspended process, unmaps its image, writes malicious PE, and resumes execution. Detected via Sysmon Event 25.
3. APC Injection: Malware queues an Asynchronous Procedure Call to threads of a target process using QueueUserAPC. Harder to detect, requires Event 10 monitoring.
4. Reflective DLL Injection: DLL is loaded directly from memory without touching disk, bypassing ImageLoaded detection. Requires memory-level analysis.
5. Process Doppelganging: Leverages NTFS transactions to replace a legitimate process image. Detected via process integrity checking.

Output Format

Hunt ID: TH-INJECT-[DATE]-[SEQ]
Host: [Hostname]
Source Process: [Injecting process path]
Source PID: [Process ID]
Target Process: [Target process path]
Target PID: [Process ID]
Injection Type: [DLL/Shellcode/Hollowing/APC]
Sysmon Events: [Event IDs triggered]
Access Mask: [Granted access value]
Risk Level: [Critical/High/Medium/Low]
ATT&CK Sub-Technique: [T1055.xxx]

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

T1055 Process Injection Hunt Template

Hunt Metadata

Field	Value
Hunt ID	TH-INJECT-YYYY-MM-DD-NNN
Analyst
Date
Status	[ ] In Progress / [ ] Complete

Hypothesis

Adversaries are injecting malicious code into legitimate system processes to evade detection and execute with elevated privileges.

Injection Findings

#	Time	Host	Source Process	Target Process	Event Type	Access Mask	Technique	Severity
1

Process Tampering Findings

#	Time	Host	Image	Tampering Type	Severity
1

Recommendations

1. Isolate: [Affected endpoints]
2. Analyze: [Memory dumps of injected processes]
3. Detect: [New Sysmon rules for observed patterns]
4. Harden: [Credential Guard, PPL for LSASS]

references/api-reference.md (verbatim)

API Reference: T1055 Process Injection Detection with Sysmon

MITRE ATT&CK T1055 Sub-Techniques

Sub-technique	Method	Sysmon Event
T1055.001	DLL Injection	Event 7, 8, 10
T1055.002	PE Injection	Event 8, 10
T1055.003	Thread Execution Hijacking	Event 8
T1055.004	Asynchronous Procedure Call	Event 8, 10
T1055.005	Thread Local Storage	Event 8
T1055.012	Process Hollowing	Event 1, 10, 25

Sysmon Event IDs

Event 8 — CreateRemoteThread

Field	Index	Description
SourceProcessGuid	1	GUID of injecting process
SourceProcessId	2	PID of injecting process
SourceImage	4	Path of injecting binary
TargetProcessGuid	5	GUID of target process
TargetProcessId	6	PID of target process
TargetImage	7	Path of target binary
StartAddress	8	Thread start address
StartFunction	9	Thread entry function

Event 10 — ProcessAccess

Field	Index	Description
SourceProcessId	3	Accessing PID
SourceImage	4	Accessing binary path
TargetProcessId	7	Accessed PID
TargetImage	8	Accessed binary path
GrantedAccess	10	Access rights mask

Event 7 — Image Loaded

Field	Index	Description
Image	3	Process that loaded DLL
ImageLoaded	5	DLL path
Signed	6	Signature status
SignatureStatus	8	Valid/Invalid/Unknown

Process Access Masks

Mask	Right	Injection Use
0x0008	PROCESS_VM_OPERATION	VirtualAllocEx
0x0010	PROCESS_VM_READ	ReadProcessMemory
0x0020	PROCESS_VM_WRITE	WriteProcessMemory
0x0800	PROCESS_SUSPEND_RESUME	Hollowing
0x001F0FFF	PROCESS_ALL_ACCESS	Full control

Sysmon Configuration for Injection Detection

<Sysmon>
  <EventFiltering>
    <ProcessAccess onmatch="include">
      <GrantedAccess condition="is">0x1F0FFF</GrantedAccess>
      <GrantedAccess condition="is">0x001F0FFF</GrantedAccess>
    </ProcessAccess>
    <CreateRemoteThread onmatch="exclude">
      <SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
    </CreateRemoteThread>
  </EventFiltering>
</Sysmon>

Sigma Rule Example

title: CreateRemoteThread into System Process
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\lsass.exe'
    filter:
        SourceImage|startswith: 'C:\Windows\System32\'
    condition: selection and not filter
level: critical

references/standards.md (verbatim)

Standards and References - T1055 Process Injection Detection

MITRE ATT&CK Process Injection Sub-Techniques

Sub-Technique	Name	API Calls	Sysmon Detection
T1055.001	Dynamic-link Library Injection	VirtualAllocEx, WriteProcessMemory, CreateRemoteThread	Event 8, 10
T1055.002	Portable Executable Injection	VirtualAllocEx, WriteProcessMemory, SetThreadContext	Event 10
T1055.003	Thread Execution Hijacking	SuspendThread, SetThreadContext, ResumeThread	Event 10
T1055.004	Asynchronous Procedure Call	OpenThread, QueueUserAPC	Event 10
T1055.005	Thread Local Storage	TLS callback manipulation	Event 10
T1055.012	Process Hollowing	CreateProcess (SUSPENDED), NtUnmapViewOfSection, WriteProcessMemory	Event 25, 10
T1055.013	Process Doppelganging	NtCreateTransaction, NtCreateSection, NtRollbackTransaction	Event 25
T1055.015	ListPlanting	SendMessage to set list item text	Limited Sysmon coverage

Critical Sysmon Events for Injection Detection

Event ID	Name	Detection Value
1	Process Create	Baseline the originating process
7	Image Loaded	Detect DLL injection from unusual paths
8	CreateRemoteThread	Primary injection indicator
10	ProcessAccess	Cross-process handle acquisition
25	ProcessTampering	Process hollowing detection (Sysmon 13+)

ProcessAccess Granted Access Masks

Access Mask	Permissions	Risk
0x1FFFFF	PROCESS_ALL_ACCESS	Critical - full process control
0x1F3FFF	Nearly all access rights	Critical
0x0040	PROCESS_VM_READ	Medium - credential dumping
0x0020	PROCESS_VM_WRITE	High - memory modification
0x0008	PROCESS_VM_OPERATION	High - memory allocation
0x0002	PROCESS_CREATE_THREAD	High - thread creation
0x143A	Combination used by Mimikatz	Critical

Common Injection Targets

Process	Why Targeted
svchost.exe	Many instances, network access, elevated privileges
explorer.exe	User context, always running, network access
lsass.exe	Credential access (T1003 overlap)
winlogon.exe	SYSTEM privileges, always running
spoolsv.exe	SYSTEM privileges, rarely monitored
dllhost.exe	COM surrogate, frequently overlooked
RuntimeBroker.exe	Common in modern Windows, rarely scrutinized

Recommended Sysmon Configuration for Injection Detection

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <RuleGroup name="ProcessInjection" groupRelation="or">
      <CreateRemoteThread onmatch="exclude">
        <SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
      </CreateRemoteThread>
      <ProcessAccess onmatch="include">
        <GrantedAccess condition="is">0x1FFFFF</GrantedAccess>
        <GrantedAccess condition="is">0x1F3FFF</GrantedAccess>
        <GrantedAccess condition="is">0x143A</GrantedAccess>
      </ProcessAccess>
      <ProcessTampering onmatch="include">
        <Type condition="is">Image is replaced</Type>
      </ProcessTampering>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

references/workflows.md (verbatim)

Detailed Hunting Workflow - T1055 Process Injection

Phase 1: CreateRemoteThread Detection (Sysmon Event 8)

Step 1.1 - Identify All Remote Thread Creation

index=sysmon EventCode=8
| where SourceImage!=TargetImage
| stats count by SourceImage TargetImage Computer
| sort -count

Step 1.2 - Filter to High-Value Target Processes

index=sysmon EventCode=8
| where match(TargetImage, "(?i)(svchost|explorer|lsass|winlogon|spoolsv|dllhost|RuntimeBroker)\.exe$")
| where NOT match(SourceImage, "(?i)(csrss|lsass|services|svchost|MsMpEng|vmtoolsd)\.exe$")
| stats count values(Computer) as hosts by SourceImage TargetImage
| sort -count

Phase 2: ProcessAccess Analysis (Sysmon Event 10)

Step 2.1 - High-Privilege Cross-Process Access

index=sysmon EventCode=10
| where GrantedAccess IN ("0x1FFFFF", "0x1F3FFF", "0x143A", "0x1F0FFF")
| where NOT match(SourceImage, "(?i)(MsMpEng|csrss|lsass|services|svchost|taskmgr|procexp)\.exe$")
| where match(TargetImage, "(?i)(lsass|svchost|explorer|winlogon)\.exe$")
| table _time Computer SourceImage TargetImage GrantedAccess CallTrace

Step 2.2 - LSASS Access for Credential Theft

index=sysmon EventCode=10
| where match(TargetImage, "(?i)lsass\.exe$")
| where match(GrantedAccess, "(0x1FFFFF|0x1F3FFF|0x0040|0x143A)")
| where NOT match(SourceImage, "(?i)(csrss|lsass|svchost|MsMpEng|WmiPrvSE)\.exe$")
| table _time Computer SourceImage GrantedAccess CallTrace

Phase 3: DLL Injection Detection (Sysmon Event 7)

Step 3.1 - DLLs Loaded from User-Writable Paths

index=sysmon EventCode=7
| where match(ImageLoaded, "(?i)\\(temp|appdata|downloads|users\\[^\\]+\\desktop)\\")
| where match(Image, "(?i)(svchost|explorer|winlogon|services)\.exe$")
| table _time Computer Image ImageLoaded Hashes Signed

Step 3.2 - Unsigned DLLs in System Processes

index=sysmon EventCode=7
| where Signed="false"
| where match(Image, "(?i)\\(svchost|services|lsass|explorer)\.exe$")
| table _time Computer Image ImageLoaded Hashes SignatureStatus

Phase 4: Process Hollowing Detection (Sysmon Event 25)

Step 4.1 - ProcessTampering Events

index=sysmon EventCode=25
| table _time Computer Image Type RuleName User

Phase 5: Correlation and Investigation

Step 5.1 - Build Full Attack Chain

index=sysmon (EventCode=1 OR EventCode=8 OR EventCode=10 OR EventCode=25)
| where match(SourceImage, "[suspected_injector]") OR match(Image, "[suspected_injector]")
| sort _time
| table _time EventCode Image SourceImage TargetImage CommandLine GrantedAccess

Step 5.2 - Memory Analysis

For confirmed injection, capture process memory using:

• PE-sieve for automated scan of hollow/injected processes
• Moneta for memory region anomaly detection
• Volatility malfind plugin for offline memory forensics

Phase 6: Response

1. Isolate affected endpoint via EDR
2. Capture memory dump before cleanup
3. Identify and remove injecting malware
4. Check for persistence mechanisms deployed by injected code
5. Sweep environment for same injection technique indicators

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.