T1055 · Process Injection

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1055 · Process Injection · Sunturai

attack-patternenterprise-attackT1055

Process Injection

attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

12 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

101 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Windows Suspicious Named Pipe	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
Windows Suspicious C2 Named Pipe	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
Windows RMM Named Pipe	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Windows PUA Named Pipe	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Cisco NVM - Suspicious Network Connection From Process With No Args	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Cisco NVM - Non-Network Binary Making Network Connection	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Unusual Service Host Child Process - Childless Service	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Parent-Child Relationship	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Conhost Spawned By Suspicious Parent Process	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Portable Executable Encoded in Powershell Script	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Child Process from a System Virtual Process	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Zoom Child Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Process Creation CallTrace	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Process Access via Direct System Call	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Managed Code Hosting Process	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Process Injection via PowerShell	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious .NET Reflection via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Endpoint Security Parent Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Process Injection by the Microsoft Build Engine	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Communication App Child Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Process Injection - Prevented - Elastic Endgame	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Process Injection - Detected - Elastic Endgame	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Windows Network Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Linux Network Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 101

Filter in the catalogue

External references

mitre-attackT1055Open reference

Platforms

LinuxmacOSWindows

Kill chain phases

privilege-escalationstealth

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object