Techniques › T1055.004 › AN0277
AN0277 Analytic 0277
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects malicious injection behavior involving memory allocation, remote thread queuing via APC (e.g., QueueUserAPC), and altered thread context within another live process to execute unauthorized code under legitimate context.</p>
- Detects
- T1055.004 Asynchronous Procedure Call
- Part of
- DET0100 Behavioral Detection of Asynchronous Procedure Call (APC) Injection via Remote Thread Queuing
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:Sysmon | EventCode=8 | DC0020 Process Modification |
| etw:Microsoft-Windows-Kernel-Process | APCQueueOperations | DC0021 OS API Execution |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
APCTargetProcessList | Processes that are rarely or never valid targets for legitimate APC queuing (e.g., lsass.exe, winlogon.exe) |
ThreadQueueDepthThreshold | The number of APCs queued within a short time window that could signal abuse |
TimeWindow | Expected latency between memory allocation and thread execution through APC |
UserContextSensitivity | Used to filter based on expected vs unexpected user to target process pairings |