Procedure examples

APT38 has injected malicious payloads into the `explorer.exe` process.

BlackByte has injected Cobalt Strike into `wuauclt.exe` during intrusions. BlackByte has injected ransomware into `svchost.exe` before encryption.

Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.

APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.

APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.

Gamaredon Group has injected Remcos into explorer.exe.

TA2541 has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe, and installutil.exe.

APT37 injects its malware variant, ROKRAT, into the cmd.exe process.

Turla has also used PowerSploit's Invoke-ReflectivePEInjection.ps1 to reflectively load a PowerShell payload into a random process on the victim system.

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its functionality.

Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.

Cobalt Group has injected code into trusted processes.

Wizard Spider has used process injection to execute payloads to escalate privileges.

Velvet Ant initial execution included launching multiple `svchost` processes and injecting code into them.

PLATINUM has used various methods of process injection including hot patching.