T1055 Process Injection Defensive Guide: Detecting and Blocking Code Injection

When malicious code runs inside a trusted process, process-based allowlists, firewall rules and parent-child analytics all see the trusted process, not the intruder. MITRE ATT&CK T1055 Process Injection covers executing code in the address space of another live process, which hides execution and can inherit that process's privileges, network access and memory. In ATT&CK v20 it belongs to both Stealth (TA0005) and Privilege Escalation (TA0004) and has twelve sub-techniques across Windows and Linux, plus macOS at the parent level. This guide explains the families at the level of the ATT&CK descriptions, then covers the telemetry and detection strategies that expose injection, the operating system mitigations that block it, and how to roll them out without breaking software. It is for detection engineers, endpoint owners and incident responders; it contains no injection code or procedures.

Key takeaways

• Injection is a cross-process event. Almost every method needs one process to open, write to or start a thread in another, which Sysmon 8 and 10, ETW and Linux audit can record.
• Target choice is the best filter. Injection into LSASS, browsers, security agents or long-running system services from an unusual source is rare in benign software; broad cross-process access is common.
• Memory evidence outlives events. Executable memory not backed by a file on disk, and hollowed images that do not match their file, are strong indicators for EDR and memory forensics.
• The platform can say no. LSA protection, exploit protection mitigations, ASR rules and Linux Yama ptrace restrictions block whole classes of injection.
• Test before enforcing. Exploit protection and LSA protection have audit modes because legitimate software, including security tools, sometimes uses the same mechanisms.

How the attack works

ATT&CK defines process injection as "a method of executing arbitrary code in the address space of a separate live process". Running in another process may give access to its memory, system and network resources and possibly elevated privileges, and execution "may also evade detection from security products since the execution is masked under a legitimate process". Many implementations abuse legitimate operating system features, and sophisticated samples split modules across several processes and talk over named pipes or other inter-process communication.

Related techniques are T1620 Reflective Code Loading (code loaded into the attacker's own process memory) and T1574 Hijack Execution Flow (making a legitimate process load attacker code at start-up). See the T1574 Hijack Execution Flow Defensive Guide.

Where it shows up

• Commodity malware and loaders: ATT&CK v20 links T1055 to 57 malware families and 15 groups, with process hollowing (.012) recorded for groups such as menuPass, Kimsuky and TA2541.
• Post-exploitation frameworks: beacons and implants that migrate into long-lived processes to survive the initial process exiting. See the Top 10 EDR Evasion Techniques.
• Supply chain implants: ATT&CK records the 3CX supply chain attack injecting a C2 module into a running browser process, so network traffic came from a browser.
• Credential theft: code injected into or reading from LSASS. See the Credential Dumping Guide.
• Linux servers: ptrace and /proc memory writes on hosts where debugging is not restricted.

Impact

• Hidden execution: process allowlisting and lineage analytics attribute activity to the host process.
• Borrowed trust: firewall rules, proxy policies and EDR exclusions for the host process now apply to the attacker.
• Privilege gain: injecting into a process running as SYSTEM or root, which is why ATT&CK also lists T1055 under Privilege Escalation.
• Fileless persistence in memory: little or nothing on disk to scan, so evidence is lost at reboot unless memory is captured.

Detection

ATT&CK v20 maps DET0508 to the parent technique. Its Windows analytic correlates remote memory allocation and writes, suspicious thread creation and unusual module loads; its Linux analytic watches ptrace, mmap and process_vm_writev system calls and access to /proc/[pid]/mem; its macOS analytic watches task-port access, memory writes and dynamic library insertion.

Memory analysis

Endpoint products and memory forensics look for private executable memory regions with no backing file, mismatches between a process's in-memory image and its file, and threads whose start addresses fall outside loaded modules. When an injection alert fires, capture memory before rebooting or killing the process. See the Memory Forensics Guide and the Volatility 3 Guide.

Tuning

• Know legitimate injectors: EDR agents, accessibility tools, debuggers, some DRM and game overlays. Allowlist by signer and path, never by process name alone.
• Prioritise targets: start with LSASS, security agent processes, browsers, Office applications and services running as SYSTEM.
• Correlate: injection plus a new outbound connection from the target is far stronger than either alone. See the Sysmon Guide.

Metrics

• Telemetry coverage: share of Windows endpoints sending Sysmon 8, 10 (filtered) and 25 or equivalent EDR events.
• LSA protection coverage: share of endpoints and servers with WinInit event 12 showing protected LSASS.
• ASR injection rule state: share of devices with "Block Office applications from injecting code into other processes" in Block mode.
• Linux ptrace restriction: share of servers with ptrace_scope set to 1 or higher.
• Memory capture rate: share of confirmed injection incidents with a memory image taken before remediation.

Prevention and hardening

Windows

• LSA protection: Microsoft states that running LSASS as a protected process prevents non-protected processes "from reading memory and injecting code". Set RunAsPPL under HKLM\SYSTEM\CurrentControlSet\Control\Lsa to 1 (UEFI lock) or 2 (no lock, Windows 11 22H2 and later). Audit first with AuditLevel = 8 under the LSASS.exe Image File Execution Options key and review events 3065 and 3066. It is on by default only for new, enterprise-joined, HVCI-capable Windows 11 22H2 and later installs.
• ASR rules (M1040): "Block Office applications from injecting code into other processes" (75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84) and "Block credential stealing from the Windows local security authority subsystem" (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2). Neither supports Warn mode; Microsoft notes the LSASS rule is redundant where LSA protection is on.
• Exploit protection (M1050): per-application mitigations such as Arbitrary code guard (no new executable memory), Code integrity guard (Microsoft-signed images only), Block remote images, Block low integrity images and Disable extension points (AppInit DLLs, legacy IMEs, event hooks). Most have audit mode; Disable extension points does not. ACG breaks JIT compilers, so apply it to applications that do not generate code.
• Application control: App Control for Business or allowlisting limits which images and DLLs can load at all. See the Application Allowlisting Guide.

Linux and macOS

• Yama ptrace scope (M1026): ATT&CK recommends restricting ptrace to privileged users. The kernel Yama documentation defines kernel.yama.ptrace_scope values: 1 restricts attach to descendants, 2 requires CAP_SYS_PTRACE, and 3 disables ptrace attach entirely and cannot then be changed. Use 2 on production servers where nobody debugs, 1 as a minimum elsewhere.
• Mandatory access control: ATT&CK also points to security modules such as SELinux and AppArmor to restrict process access.
• macOS: keep System Integrity Protection and hardened runtime enabled for in-house applications, and watch for dynamic library insertion in ATT&CK's macOS analytic.

Choosing controls

Phased rollout

1. Telemetry: deploy Sysmon or confirm EDR coverage of cross-process events, with filtered event 10.
2. Audit: LSA protection audit mode, ASR rules in Audit and exploit protection audit for chosen applications, for two to four weeks.
3. Fix compatibility: update or replace plug-ins and add-ins that fail; document any exception with an owner.
4. Enforce in rings: pilot, then broad deployment. Rollback is policy removal, except LSA protection with UEFI lock, which needs Microsoft's opt-out tool.
5. Linux: set ptrace_scope through configuration management; avoid value 3 until you are sure nothing needs ptrace, because it cannot be lowered without a reboot.
6. Validate: run authorised injection emulations in a lab and confirm alerts. See the Purple Teaming Guide.

Common failure patterns

• Unfiltered Sysmon 10: collected from every process, it floods the SIEM and is dropped; filter to sensitive targets and access masks.
• Name-based allowlists: excluding a process by name lets an attacker inject into exactly that process. See the EDR Tuning and Exclusions Management Guide.
• Killing before capturing: terminating the injected process or rebooting removes the in-memory evidence.
• LSA protection never verified: policy set but WinInit event 12 absent because a reboot or a plug-in failure stopped it.
• Developer hosts left open: ptrace_scope 0 on shared Linux jump hosts.

Framework mapping

Where identity fits

Injection is often a route to identity material: tokens, tickets and secrets held in the memory of LSASS, browsers, agents and services running as service accounts. Protect those processes first, keep service accounts out of interactive sessions so their credentials are not in workstation memory, and rotate any credential held by a process found injected. See the Service Account Security Guide.

Practitioner checklist

• Collect Sysmon 8, 25 and filtered 10 (or EDR equivalents) and alert on injection into LSASS, browsers and security agents.
• Enable LSA protection after audit mode, and confirm WinInit event 12 on every host.
• Run the Office injection and LSASS ASR rules in Audit, then Block.
• Apply exploit protection mitigations, starting in audit, to high-risk applications that do not use JIT.
• Set Linux ptrace_scope to 1 or 2 and audit ptrace and process_vm_writev calls.
• Allowlist legitimate injectors by signer and path, and review the list quarterly.
• Capture memory before killing a process flagged for injection.
• Rotate credentials held by any process confirmed as injected.

Standards and references

• MITRE ATT&CK: Process Injection (T1055)
• MITRE ATT&CK: Process Hollowing (T1055.012)
• MITRE ATT&CK: Ptrace System Calls (T1055.008)
• Microsoft Learn: Sysmon
• Microsoft Learn: Configure added LSA protection
• Microsoft Learn: Exploit protection reference
• Microsoft Learn: Attack surface reduction rules reference
• Linux kernel documentation: Yama

Related NHI Mgmt Group resources: Top 10 EDR Evasion Techniques · EDR Evasion and Defence Guide · Memory Forensics Guide · ATT&CK Stealth and Defense Impairment Tactics Guide · Credential Dumping Guide