What it does. Detects process injection techniques (MITRE T1055) — including Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-process-injection-techniques, or copy the skill folder into ~/.claude/skills/hunting-for-process-injection-techniques/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-process-injection-techniques/SKILL.md

SKILL.md (verbatim)

name: hunting-for-process-injection-techniques
description: Detects process injection techniques (MITRE T1055) — including
  CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing
  Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process
  telemetry. Use when hunting for in-memory code injection or defense evasion via
  legitimate process abuse on Windows endpoints.
domain: cybersecurity
subdomain: threat-hunting
tags:
- process-injection
- t1055
- sysmon
- createremotethread
- dll-injection
- edr
- threat-hunting
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Content Format Conversion
- File Content Analysis
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1055

Hunting for Process Injection Techniques

Overview

Process injection (MITRE ATT&CK T1055) allows adversaries to execute code in the address space of another process, enabling defense evasion and privilege escalation. This skill detects injection techniques via Sysmon Event ID 8 (CreateRemoteThread), Event ID 10 (ProcessAccess with suspicious access rights), and analysis of source-target process relationships to distinguish legitimate from malicious injection.

When to Use

• When investigating security incidents that require hunting for process injection techniques
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Sysmon installed with Event IDs 8 and 10 enabled
• Process creation logs (Sysmon Event ID 1 or Windows 4688)
• Python 3.8+ with standard library
• JSON-formatted Sysmon event logs

Steps

1. Parse Sysmon Events — Ingest Event IDs 1, 8, and 10 from JSON log files
2. Detect CreateRemoteThread — Flag Event ID 8 with suspicious source-target process pairs
3. Analyze ProcessAccess Rights — Identify Event ID 10 with dangerous access masks (PROCESS_VM_WRITE, PROCESS_CREATE_THREAD)
4. Build Process Relationship Graph — Map source-to-target injection relationships
5. Filter Known Legitimate Pairs — Exclude known benign injection patterns (AV, debuggers, system processes)
6. Score Injection Severity — Apply risk scoring based on source process, target process, and access rights
7. Generate Hunt Report — Produce structured report with MITRE sub-technique mapping

Expected Output

• JSON report of detected injection events with severity scores
• Process injection relationship graph
• MITRE ATT&CK sub-technique mapping (T1055.001-T1055.012)
• False positive exclusion recommendations

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

Process Injection Detection API Reference

Sysmon Event ID 8 — CreateRemoteThread

<EventID>8</EventID>
<Data Name="SourceImage">C:\Users\attacker\malware.exe</Data>
<Data Name="TargetImage">C:\Windows\System32\svchost.exe</Data>
<Data Name="StartFunction">LoadLibraryA</Data>
<Data Name="StartModule">C:\Users\attacker\evil.dll</Data>
<Data Name="NewThreadId">12345</Data>
<Data Name="SourceProcessId">1234</Data>
<Data Name="TargetProcessId">5678</Data>

Sysmon Event ID 10 — ProcessAccess

<EventID>10</EventID>
<Data Name="SourceImage">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data>
<Data Name="TargetImage">C:\Windows\System32\lsass.exe</Data>
<Data Name="GrantedAccess">0x1F0FFF</Data>
<Data Name="SourceProcessId">4444</Data>
<Data Name="TargetProcessId">680</Data>

Dangerous Access Rights Masks

Sysmon Configuration for Injection Detection

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <!-- CreateRemoteThread -->
    <CreateRemoteThread onmatch="exclude">
      <SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
    </CreateRemoteThread>

    <!-- ProcessAccess to LSASS -->
    <ProcessAccess onmatch="include">
      <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
    </ProcessAccess>
  </EventFiltering>
</Sysmon>

Splunk Detection Queries

# CreateRemoteThread from Office apps
index=sysmon EventCode=8
| where match(SourceImage, "(?i)(winword|excel|powerpnt|outlook)\.exe$")
| table _time SourceImage TargetImage StartFunction User

# Suspicious ProcessAccess to LSASS
index=sysmon EventCode=10 TargetImage="*lsass.exe"
  GrantedAccess IN ("0x1F0FFF", "0x143A", "0x001A")
| where NOT match(SourceImage, "(?i)(csrss|MsMpEng|avp)\.exe$")
| stats count by SourceImage GrantedAccess

MITRE ATT&CK T1055 Sub-techniques

Atomic Red Team Tests

# T1055.001 - DLL Injection via CreateRemoteThread
Invoke-AtomicTest T1055.001

# T1055.012 - Process Hollowing
Invoke-AtomicTest T1055.012

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.