H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Process Injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

103 recorded

Relationships

mapped-to
from Local Code Inclusion
Technique
mapped-to
from Root/Jailbreak Detection Evasion via Hooking
Technique
mitigates
from Behavior Prevention on Endpoint
Mitigation
mitigates
from Privileged Account Management
Mitigation
subtechnique-of
from Asynchronous Procedure Call
Technique
subtechnique-of
from Dynamic-link Library Injection
Technique
subtechnique-of
from Extra Window Memory Injection
Technique
subtechnique-of
from ListPlanting
Technique
subtechnique-of
from Portable Executable Injection
Technique
subtechnique-of
from Process Doppelgänging
Technique
subtechnique-of
from Process Hollowing
Technique
subtechnique-of
from Proc Memory
Technique
subtechnique-of
from Ptrace System Calls
Technique
subtechnique-of
from Thread Execution Hijacking
Technique
subtechnique-of
from Thread Local Storage
Technique
subtechnique-of
from VDSO Hijacking
Technique
uses
from 2015 Ukraine Electric Power Attack
Campaign
uses
from 3CX Supply Chain Attack
Campaign
uses
from ABK
Malware
uses
from Agent Tesla
Malware
uses
from ANDROMEDA
Malware
uses
from APT32
Group
uses
from APT37
Group
uses
from APT38
Group
uses
from APT41
Group
uses
from APT5
Group
uses
from ArcaneDoor
Campaign
uses
from Attor
Malware
uses
from AuditCred
Malware
uses
from Avenger
Malware
uses
from Backdoor.Oldrea
Malware
uses
from BADHATCH
Malware
uses
from Bazar
Malware
uses
from BBK
Malware
uses
from BlackByte
Group
uses
from BlackByte 2.0 Ransomware
Malware
uses
from Bumblebee
Malware
uses
from Cardinal RAT
Malware
uses
from Clambling
Malware
uses
from COATHANGER
Malware
uses
from Cobalt Group
Group
uses
from Cobalt Strike
Malware
uses
from CostaBricks
Malware
uses
from Cutting Edge
Campaign
uses
from Donut
Tool
uses
from DOWNIISSA
Malware
uses
from DUSTTRAP
Malware
uses
from Dyre
Malware
uses
from Egregor
Malware
uses
from Empire
Tool
uses
from Gamaredon Group
Group
uses
from Gazer
Malware
uses
from gh0st RAT
Malware
uses
from GuLoader
Malware
uses
from HiddenFace
Malware
uses
from HOPLIGHT
Malware
uses
from HTRAN
Tool
uses
from HyperBro
Malware
uses
from InvisiMole
Malware
uses
from IronNetInjector
Tool
uses
from JHUHUGIT
Malware
uses
from JPIN
Malware
uses
from Kimsuky
Group
uses
from Lizar
Malware
uses
from LODEINFO
Malware
uses
from metaMain
Malware
uses
from Mispadu
Malware
uses
from Mis-Type
Malware
uses
from NavRAT
Malware
uses
from NETWIRE
Malware
uses
from Ninja
Malware
uses
from NOOPLDR
Malware
uses
from Operation Sharpshooter
Campaign
uses
from Operation Wocao
Campaign
uses
from Pandora
Malware
uses
from PcShare
Tool
uses
from PLATINUM
Group
uses
from PoshC2
Tool
uses
from PureCrypter
Malware
uses
from QakBot
Malware
uses
from RedPenguin
Campaign
uses
from Remcos
Tool
uses
from REvil
Malware
uses
from ROKRAT
Malware
uses
from Ryuk
Malware
uses
from ShadowPad
Malware
uses
from Silence
Group
uses
from SILENTTRINITY
Tool
uses
from Sliver
Tool
uses
from SLOTHFULMEDIA
Malware
uses
from Smoke Loader
Malware
uses
from StoneDrill
Malware
uses
from TA2541
Group
uses
from TrickBot
Malware
uses
from TSCookie
Malware
uses
from Turla
Group
uses
from Velvet Ant
Group
uses
from WarzoneRAT
Malware
uses
from Waterbear
Malware
uses
from Wiarp
Malware
uses
from Wingbird
Malware
uses
from Wizard Spider
Group
uses
from Woody RAT
Malware
1 external

References

mitre-attack
T1055
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance