Detecting Process Injection (T1055): Hollowing, Shellcode, and DLL Injection

Process injection is one of the most abused techniques in post-exploitation tradecraft. It lets attackers execute code inside a legitimate, trusted process — appearing as svchost.exe, explorer.exe, or lsass.exe in the process tree rather than malware.exe. Nearly every major C2 framework (Cobalt Strike, Brute Ratel, Sliver, Havoc) uses injection as a core evasion mechanism. So does most commercial spyware and a substantial fraction of commodity malware.

T1055 encompasses a broad category, but the sub-techniques that matter most for defenders are:

• T1055.001 — DLL Injection: force a target process to load an attacker-controlled DLL
• T1055.002 — Portable Executable Injection: write raw PE bytes into a remote process and execute them
• T1055.003 — Thread Execution Hijacking: suspend a thread, overwrite its context to point at shellcode, resume
• T1055.012 — Process Hollowing: spawn a legitimate process in suspended state, replace its code with malicious code, resume
• T1055.014 — VDSO Hijacking: target Linux’s virtual dynamic shared object (less common on Windows-centric environments)

This guide focuses on detection logic for Windows endpoints — the primary target in enterprise environments.

How Each Technique Works

DLL Injection (T1055.001)

The canonical sequence:

1. OpenProcess with PROCESS_VM_WRITE | PROCESS_CREATE_THREAD permissions on the target
2. VirtualAllocEx to allocate memory in the remote process
3. WriteProcessMemory to write the DLL path into allocated memory
4. CreateRemoteThread pointing at LoadLibraryW as the start address

Windows automatically loads the DLL and runs its DllMain. The injected thread appears to belong to the target process.

Process Hollowing (T1055.012)

1. CreateProcess with CREATE_SUSPENDED flag — process starts but doesn’t run
2. NtUnmapViewOfSection (or ZwUnmapViewOfSection) to remove the original executable mapping from the process’s memory
3. VirtualAllocEx to allocate space for the malicious PE
4. WriteProcessMemory to copy the malicious PE into the new allocation
5. SetThreadContext to redirect the main thread’s entry point
6. ResumeThread — the process now executes the malicious code under the identity of the hollowed process

The hollowed process has the legitimate name and parent, but its memory sections contain attacker code.

Shellcode Injection (T1055.002 / reflective variants)

The simplest form: allocate, write, and execute a shellcode blob without needing a DLL or PE header. Often used with reflective loading to avoid disk writes entirely. Modern C2 beacons (Cobalt Strike’s default sleep technique) use this pattern along with memory obfuscation to hide from memory scanners.

Detection Approach

Process injection leaves traces at multiple layers:

Sigma Rules

Rule 1: Suspicious Cross-Process Memory Allocation (CreateRemoteThread)

title: Suspicious CreateRemoteThread Injection
id: a8e27e35-b3d2-4f9a-b5e6-3de5a7c12f01
status: stable
description: Detects CreateRemoteThread calls where source and target processes differ — a core indicator of process injection.
references:
  - https://attack.mitre.org/techniques/T1055/
author: SOC Analyst Hub
date: 2026/07/12
tags:
  - attack.defense_evasion
  - attack.t1055
  - attack.privilege_escalation
logsource:
  category: create_remote_thread
  product: windows
detection:
  selection:
    SourceImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
    TargetImage|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
      - '\notepad.exe'
      - '\lsass.exe'
      - '\spoolsv.exe'
      - '\winlogon.exe'
  condition: selection
falsepositives:
  - Legitimate software updaters injecting into host processes (rare)
  - AV/EDR self-protection mechanisms
level: high

Rule 2: Process Hollowing Indicator — Suspend + Unmap Pattern

title: Process Hollowing via NtUnmapViewOfSection
id: b4c91e2a-1f7d-4a8e-9b3c-7d2e5a8f1e92
status: experimental
description: Detects use of NtUnmapViewOfSection on a remotely-created process, characteristic of process hollowing.
references:
  - https://attack.mitre.org/techniques/T1055/012/
author: SOC Analyst Hub
date: 2026/07/12
tags:
  - attack.defense_evasion
  - attack.t1055.012
logsource:
  product: windows
  category: process_access
detection:
  selection:
    GrantedAccess: '0x1fffff'  # PROCESS_ALL_ACCESS
    CallTrace|contains: 'ntdll.dll+NtUnmapViewOfSection'
  filter_legit:
    SourceImage|contains:
      - 'MsMpEng.exe'
      - 'csrss.exe'
  condition: selection and not filter_legit
falsepositives:
  - Rare — legitimate use of NtUnmapViewOfSection is extremely uncommon
level: high

Rule 3: Shellcode via VirtualAllocEx + WriteProcessMemory + CreateRemoteThread Sequence

title: Classic Shellcode Injection Trifecta
id: c7d83f1b-2e9a-4c7d-8e1f-9a3b5c7d2e1f
status: stable
description: Detects the classic three-API process injection sequence logged via ETW or security product telemetry.
references:
  - https://attack.mitre.org/techniques/T1055/002/
author: SOC Analyst Hub
date: 2026/07/12
tags:
  - attack.defense_evasion
  - attack.t1055.002
logsource:
  product: windows
  category: process_creation
detection:
  sequence:
    - id: alloc
      type: process_access
      fields:
        GrantedAccess|contains: '0x40'  # MEM_COMMIT bit
    - id: write
      type: process_access
      fields:
        CallTrace|contains: 'WriteProcessMemory'
    - id: thread
      type: create_remote_thread
      fields:
        StartFunction|contains: 'LoadLibrary'
  condition: alloc and write and thread within 30s
level: medium

KQL Queries (Microsoft Sentinel / Defender XDR)

Detecting Suspicious Process Access Combinations

// Detect processes accessing other processes with injection-relevant rights
DeviceEvents
| where ActionType == "OpenProcess"
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe",
    "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| where AdditionalFields has_any ("0x1fffff", "0x40", "PROCESS_CREATE_THREAD",
    "PROCESS_VM_WRITE", "PROCESS_VM_READ")
| project Timestamp, DeviceName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName, AdditionalFields
| order by Timestamp desc

CreateRemoteThread Across Process Boundary

// Sysmon Event ID 8 equivalent in Defender XDR
DeviceEvents
| where ActionType == "CreateRemoteThreadApiCall"
| where InitiatingProcessFileName !in~ (
    "MsMpEng.exe", "MsSense.exe", "SenseIR.exe", "csrss.exe",
    "svchost.exe", "SearchIndexer.exe")
| where FileName in~ (
    "svchost.exe", "lsass.exe", "explorer.exe", "spoolsv.exe",
    "winlogon.exe", "services.exe", "notepad.exe")
| extend IsCrossProcess = (InitiatingProcessId != InitiatingProcessParentId)
| project Timestamp, DeviceName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName, ProcessId
| order by Timestamp desc

RWX Memory Allocations in Unusual Processes

// Memory allocations with Read/Write/Execute permissions in non-dev processes
DeviceEvents
| where ActionType == "MemoryAllocated"
| where AdditionalFields has "PAGE_EXECUTE_READWRITE"
| where InitiatingProcessFileName !in~ (
    "node.exe", "python.exe", "javaw.exe", "jvm.dll",
    "chrome.exe", "msedge.exe", "firefox.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, AdditionalFields
| order by Timestamp desc

EDR Blind Spots and Advanced Evasion

Modern attackers have adapted injection techniques to evade EDR hooks placed in NTDLL:

Direct syscalls: Instead of calling NtCreateThread via NTDLL (where EDR hooks live), malware resolves the syscall number directly and invokes the kernel without going through the hooked DLL. Sysmon won’t log these; you need kernel-level ETW or a hypervisor-based solution.

Module stomping: Overwriting a legitimate, already-loaded DLL’s code sections (rather than allocating new RWX memory) avoids the RWX allocation indicator. Memory scanning tools detect this by checking whether in-memory DLL content matches the on-disk version.

Sleep obfuscation: Cobalt Strike’s Ekko and similar techniques encrypt the beacon’s memory when sleeping and decrypt it only when active, evading memory scanners that run during sleep intervals.

For these techniques, the detection focus shifts from API call patterns to:

• Unbacked executable memory (code running from memory regions not mapped to any file on disk)
• Thread start addresses in anonymous memory regions
• Modules loaded with mismatched hashes compared to on-disk versions

Tuning Recommendations

These rules will generate noise in environments with:

• Software deployment tools (SCCM, Intune) that legitimately inject into processes
• Security products with self-protection or cross-process inspection features
• JVM-based applications with JIT compilation (RWX allocations are expected)

Build an allowlist of known legitimate injectors (MsMpEng.exe, SenseCncProxy.exe, deployment tools) and exclude them from the broad rules. Start monitoring on high-value targets (IT admin endpoints, servers, domain controllers) before rolling out broadly.