A comprehensive guide to process injection techniques — DLL injection, PE injection, process hollowing, APC injection, thread execution hijacking — and how analysts detect each sub-technique across T1055.
Process injection is a defense evasion technique where an attacker runs malicious code inside the memory space of a trusted process (e.g., explorer.exe, svchost.exe, lsass.exe, notepad.exe).
Because the injected code runs within the context of the legitimate process, it inherits that process’s permissions, network access, and trust level. A firewall rule that allows svchost.exe to reach the internet also allows injected code inside svchost.exe to reach the internet.
Process injection is MITRE ATT&CK T1055 with 13 sub-techniques. This article covers the most common ones: DLL injection (T1055.001), PE injection (T1055.002), thread execution hijacking (T1055.003), process hollowing (T1055.012), and APC injection (T1055.004).
Process injection is the standard technique for: credential dumping tools (Mimikatz injecting into lsass.exe), C2 frameworks (Cobalt Strike’s execute-assembly, shinject), and info stealers running inside browser processes.
DLL Injection (T1055.001)
The attacker writes the path to a malicious DLL into the target process’s address space, then forces the process to load it.
How It Works
Step
API Call
What Happens
1
OpenProcess(PROCESS_ALL_ACCESS, FALSE, targetPID)
Opens a handle to the target process with full access
Creates a thread in the target process that starts at LoadLibraryA with the DLL path as argument
Detection Signals
Signal
What to Look For
Sysmon Event ID
CreateRemoteThread
Process A creating a thread in Process B — especially if A is a suspicious process (e.g., wmiprvse.exe, rundll32.exe, or a document reader)
Sysmon Event ID 8
Unexpected DLL load
A process loading a DLL from a user-writable path (AppData, Temp, Downloads)
Sysmon Event ID 7
LoadLibrary call pattern
LoadLibraryA or LoadLibraryW called with unusual arguments
EDR API monitoring
Target process privilege
If the target is lsass.exe, the attacker is hunting credentials
Sysmon Event ID 10 (ProcessAccess to lsass)
SPL query — detect CreateRemoteThread (Sysmon Event ID 8):
index=windows sourcetype="WinEventLog:Sysmon" EventCode=8| eval source_process = SourceProcessGuid| eval target_process = TargetProcessGuid| where SourceImage NOT IN ("C:\\Program Files\\*", "C:\\Windows\\System32\\svchost.exe")| eval alert = "CreateRemoteThread from " . SourceImage . " to " . TargetImage| table _time, Computer, SourceImage, TargetImage, alert
PE Injection (T1055.002)
Instead of making the target process load a DLL on disk, the attacker writes the entire Portable Executable (EXE or DLL) into the target’s memory directly.
Memory protection change to PAGE_EXECUTE_READWRITE
A memory region that was PAGE_READWRITE (data) is changed to PAGE_EXECUTE_READWRITE (code) without a corresponding file mapping
DLL loaded with no on-disk file
The injected DLL has no corresponding .dll file on disk — it only exists in memory
Modified memory in suspicious regions
EDRs detect anonymous memory regions (not backed by a file on disk, not heap, not stack) that contain code
Process Hollowing (T1055.012)
The attacker starts a legitimate process in a suspended state, replaces its code, then resumes it. The process appears legitimate to users and tools, but its code is malicious.
How It Works
Step
API Call
What Happens
1
CreateProcess(suspended)
Starts a legitimate process (svchost.exe, notepad.exe, rundll32.exe) in CREATE_SUSPENDED state
2
NtUnmapViewOfSection(hProcess, originalImageBase)
Unmaps the original executable code from the process
Points the thread entry point to the malicious code
6
ResumeThread(hThread)
Resumes the process — it now runs the attacker’s code under the legitimate process name
Detection Signals
Signal
What to Look For
Sysmon Event ID
Process in suspended state
CreateProcess with CREATE_SUSPENDED flag — very rare for legitimate software
EDR — process creation flags
Thread start address != process entry point
The main thread starts at an address that does not match any of the process’s known exports
Sysmon Event ID 1 — check Image vs ParentImage
Process memory layout anomaly
No executable section mapped at the process’s preferred base address
Memory forensics with Volatility (malfind, ldrmodules)
Process hollowing from a parent that should not create processes
wmiprvse.exe spawning rundll32.exe suspended, or WINWORD.EXE spawning notepad.exe
Sysmon Event ID 1 — parent-child relationship
SPL query — detect suspended process creation:
index=windows sourcetype="WinEventLog:Sysmon" EventCode=1| search CommandLine="*suspended*" OR CommandLine="*-CREATE_SUSPENDED*" OR CommandLine="*suspended*" ParentCommandLine="*"| eval alert = "SUSPENDED PROCESS — " . Image . " launched with create_suspended flag — possible hollowing"| table _time, Computer, Image, CommandLine, ParentImage, alert
APC Injection (T1055.004)
Asynchronous Procedure Calls (APCs) are a Windows mechanism for executing code in the context of a specific thread. Attackers queue malicious APCs to threads in target processes.
How It Works
Step
API Call
What Happens
1
OpenThread
Opens a handle to a thread in the target process
2
VirtualAllocEx + WriteProcessMemory
Writes shellcode to the target process memory
3
QueueUserAPC(shellcodeAddr, hThread, NULL)
Queues an APC that points to the shellcode. The next time the thread enters an alertable state (WaitForSingleObjectEx, SleepEx, MsgWaitForMultipleObjectsEx), the APC fires and executes the shellcode
Detection Signals
Signal
What to Look For
APC queue notifications
EDR sensors that monitor QueueUserAPC calls (not all do — this is a blind spot for many tools)
Suspicious thread execution start
A thread starting from an unexpected address without a corresponding process creation event
Alertable wait detection
Processes entering alertable wait states more frequently than expected
Thread Execution Hijacking (T1055.003)
Instead of creating a new thread, the attacker takes control of an existing thread in the target process.
How It Works
Step
API Call
What Happens
1
OpenThread(targetThread)
Opens a handle to a running thread
2
SuspendThread(hThread)
Suspends the thread’s execution
3
GetThreadContext(hThread, &context)
Saves the current thread context (registers, instruction pointer)
