Table of contents

Process Injection TechniquesWin32 API usedMITRE ATT&CKDetection
Process HollowingCreateProcess, ReadProcessMemory, NtUnmapViewOfSection,CreateFile , VirtualAllocEx, ReadProcessMemory,WriteProcessMemory, SetThreadContext, ResumeThread.T1055.012DS0009
Process GhostingCreateFile,GetFileSize,VirtualAlloc,ReadFile,NtOpenFile,NtSetInformationFile,WriteFile,NtCreateSection,NtCreateProcessEx,...
RWX Hunting&InjectionNtGetProcess,GetProcessImageFileName,VirtualQueryEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject.
Classic Code Injection Local ProcessVirtualAlloc,memcpy,CreateThread,WaitForSingleObject.
Classic Code Injection Remote ProcessCreateToolhelp32Snapshot,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject.
Classic Code Injection VirtualProtectCreateToolhelp32Snapshot,OpenProcess,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,WaitForSingleObject.
Classic Code Injection with API ObfuscationCreateToolhelp32Snapshot,OpenProcess,Deobfuscation,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject.
NtCreateSection and NtMapViewOfSectionNtCreateSection,NtMapViewOfSection,OpenProcess,NtMapViewOfSection,memcpy,CreateRemoteThread.
NT API InjectionEnumProcess,OpenProcess,GetModuleFileNameEx,GetProcAddress,NtOpenProcess,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx.
Fork API Injection (Dirty Vanity)
PE InjectionCreateToolhelp32Snapshot,Process32FirstW???,GetModuleHandle,VirtualAlloc,VirtualAllocEx,WriteProcessMemory,CreateRemoteThreadT1055.002DS0009
PEB Walk InjectionEnumProcess,OpenProcess,non-volatile-register-retrieval,CONTAINING_RECORD,GetProcAddressKernel32,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread.
PEB Walk and APIs Obfuscation TechniqueEnumProcess,OpenProcess,non-volatile-register-retrieval,CONTAINING_RECORD,GetProcAddressKernel32,Deobfuscation,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread.
Direct SyscallsCreateToolhelp32Snapshot,NtOpenProcess,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx.
Indirect SyscallsEnumProcess,OpenProcess,GetModuleFileNameEx.
Classic DLL InjectionT1055.001DS0009, DS0011
Reflective DLL InjectionCreateFile,GetFileSize,ReadFile,VirtualAllocEx,WriteProcessMemory,“
Unhook ntdll.dll (Lagos Island)CreateFile,GetFileSize, malloc,ReadFile,VirtualAlloc,CopyMemory,LoadLibrary,GetProcAddress, NtAllocateVirtualMemory,memcpy, NtCreateThreadEx.
Module StompingEnumProcess,OpenProcess,EnumProcessModules,GetModuleFileNameEx,VirtualAllocEx,WriteProcessMemory,GetProcAddress,CreateRemoteThread,FindModuleBase,WriteProcessMemory,CreateRemoteThread.
Mokingjay
Remote Thread HijackingEnumProcess,OpenProcess,GetModuleFileNameEx,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateToolhelp32Snapshot,Thread32First,Thread32Next,OpenThread,SuspendThread,GetCurrentThreadContext,SetThreadContext,ResumeThread.T1055.003DS0009
APC InjectionCreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateToolhelp32Snapshot,Thread32First,Thread32Next,OpenThread,QueueUserAPC.T1055.004DS0009
Early Bird Injection
AddressOfEntryPoint InjectionNtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,WriteProcessMemory,NtResumeThread.
Injection through Fibers