T1055 Process Injection

Technique: T1055
Tactics: Defense Evasion, Privilege Escalation
Research, 90 days: 4
KEV CVEs mapped: 19
SigmaHQ rules: 36
Elastic, Splunk: 60
thrunt rules: 1
Upstream: https://attack.mitre.org/techniques/T1055

MITRE description

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-10-06 Flare: CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

thrunt rules

t1055-rundll32-spawning-explorer-injection

SigmaHQ community rules

Malware Shellcode in Verclsid Target Process (emerging-threats)
Potential Dridex Activity (emerging-threats)
Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection (emerging-threats)
APT PRIVATELOG Image Load Pattern (emerging-threats)
Injected Browser Process Spawning Rundll32 - GuLoader Activity (emerging-threats)
Lummac Stealer Activity - Execution Of More.com And Vbc.exe (emerging-threats)
RedSun - Named Pipe Created (emerging-threats)
RedSun - TieringEngineService.exe Detected as EICAR Test File (emerging-threats)
Remote Thread Created In Shell Application (threat-hunting)
Potential Shellcode Injection (threat-hunting)
Potential Executable Run Itself As Sacrificial Process (threat-hunting)
Rare Remote Thread Creation By Uncommon Source Image (core)
Remote Thread Creation By Uncommon Source Image (core)
Created Files by Microsoft Sync Center (core)
Potential DLL Sideloading Using Coregen.exe (core)
DotNet CLR DLL Loaded By Scripting Applications (core)
Network Connection Initiated Via Notepad.EXE (core)
Microsoft Sync Center Suspicious Network Connections (core)
CobaltStrike Named Pipe Pattern Regex (core)
CobaltStrike Named Pipe Patterns (core)
CobaltStrike Named Pipe (core)
HackTool - CoercedPotato Named Pipe Creation (core)
HackTool - EfsPotato Named Pipe Creation (core)
Malicious Named Pipe Created (core)
PowerShell ShellCode (core)

Showing 25 of 36 community rules. the full set is tagged attack.t1055 in SigmaHQ.

Elastic and Splunk rules

Memory Threat - Detected - Elastic Defend (elastic)
Memory Threat - Prevented- Elastic Defend (elastic)
Linux Process Hooking via GDB (elastic)
Potential Fileless Execution via Unusual memfd Create Call (elastic)
Privilege Escalation via GDB CAP_SYS_PTRACE (elastic)
Root Network Connection via GDB CAP_SYS_PTRACE (elastic)
Potential Sudo Token Manipulation via Process Injection (elastic)
Unusual Linux Network Activity (elastic)
Unusual Windows Network Activity (elastic)
Process Injection - Detected - Elastic Endgame (elastic)
Process Injection - Prevented - Elastic Endgame (elastic)
Suspicious Communication App Child Process (elastic)
Process Injection by the Microsoft Build Engine (elastic)
Suspicious Endpoint Security Parent Process (elastic)
Suspicious .NET Reflection via PowerShell (elastic)
Potential Process Injection via PowerShell (elastic)
Suspicious Managed Code Hosting Process (elastic)
Suspicious Process Access via Direct System Call (elastic)
Suspicious Process Creation CallTrace (elastic)
Suspicious Zoom Child Process (elastic)
Unusual Child Process from a System Virtual Process (elastic)
Potential PowerShell HackTool Script by Function Names (elastic)
Suspicious Portable Executable Encoded in Powershell Script (elastic)
Conhost Spawned By Suspicious Parent Process (elastic)
Unusual Parent-Child Relationship (elastic)

Showing 25 of 60.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.