T1055.002 Portable Executable Injection

Technique: T1055.002
Tactics: Defense Evasion, Privilege Escalation
Research, 90 days: 1
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 4
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1055/002

MITRE description

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>, then invoked with <code>CreateRemoteThread</code> or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.(Citation: Elastic Process Injection July 2017) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT

Detection coverage

Elastic and Splunk rules

Suspicious .NET Reflection via PowerShell (elastic)
Potential Process Injection via PowerShell (elastic)
Windows Process Injection into Commonly Abused Processes (splunk)
Windows Process Injection Remote Thread (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.