Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1055

Process Injection

Linux · macOS · Windows4 pieces on this siteT1055 on attack.mitre.org

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

Detect it

1

Hunts and rules you can run, each stating what it needs and what else it returns.

The evidence it leaves

1

Where the traces live, and what each source proves and does not.

Read

2

Analyses, case studies, guides, references and interview questions.

Guide

False-Positive Hall of Fame No. 1: six alerts that were the software working

Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.

T1055

how MITRE says to see it

Behavioral Detection of Process Injection Across Platforms

  • Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.
  • Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.
  • Detects memory-based injection by monitoring `task_for_pid`, `mach_vm_write`, and dylib injection patterns through `DYLD_INSERT_LIBRARIES` or manual memory mapping.

what reduces it

  • M1040 Behavior Prevention on Endpoint. Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection.
  • M1026 Privileged Account Management. Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurity, and AppArmor.

sub-techniques

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.