Sub-technique of T1055 Process Injection.View on attack.mitre.org
Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL).
Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).
Another variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process. This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process.
Rules on DetectionCode tagged with T1055.001.
| Rule | Level | Log source |
|---|---|---|
| HackTool - Potential CobaltStrike Process Injection | high | windows / create_remote_thread |
| ManageEngine Endpoint Central Dctask64.EXE Potential Abuse | high | windows / process_creation |
| Mavinject Inject DLL Into Running Process | high | windows / process_creation |
| Renamed Mavinject.EXE Execution | high | windows / process_creation |
| Renamed ZOHO Dctask64 Execution | high | windows / process_creation |
| Potential DLL Injection Or Execution Using Tracker.exe | medium | windows / process_creation |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Loading Of Dynwrapx Module | TTP | NULL | Sysmon EventID 7 |
| PowerShell PInvoke Process Injection API Chain | TTP | NULL | Powershell Script Block Logging 4104 |
| Windows Process Injection Of Wermgr to Known Browser | TTP | NULL | Sysmon EventID 8 |
| Windows Rasautou DLL Execution | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Windows Uncommon Remote Thread Creation In Browser Process | Anomaly | NULL | Sysmon EventID 8 |
| Used by | Procedure example |
|---|---|
| GroupBackdoorDiplomacy | BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs. |
| GroupKimsuky | Kimsuky has the ability to load DLLs via reflective injection by allocating memory using `VirtualAllocEx()`, then decrypting a DLL with `WriteProcessMemory()` and invoking execution through `CreateRemoteThread()`. |
| GroupLazarus Group | A Lazarus Group malware sample performs reflective DLL injection. |
| GroupLeviathan | Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim. |
| GroupMalteiro | |
| GroupPutter Panda | An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe). |
| GroupTA505 | TA505 has been seen injecting a DLL into winword.exe. |
| GroupTropic Trooper | Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe. |
| Used by | Procedure example |
|---|---|
| MalwareAria-body | Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe. |
| MalwareBADHATCH | BADHATCH has the ability to execute a malicious DLL by injecting into `explorer.exe` on a compromised machine. |
| MalwareBlackEnergy | BlackEnergy injects its DLL component into svchost.exe. |
| MalwareBumblebee | The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes. |
| MalwareCarberp | Carberp's bootkit can inject a malicious DLL into the address space of running processes. |
| MalwareCarbon | Carbon has a command to inject code into a process. |
| MalwareCobalt Strike | Cobalt Strike has the ability to load DLLs via reflective injection. |
| MalwareComRAT | ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
