{"id":"T1055.001","name":"Dynamic-link Library Injection","url":"https://attack.mitre.org/techniques/T1055/001","tactics":["stealth","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0389","stix_id":"x-mitre-detection-strategy--e9c54806-2d8e-4722-805c-4a1e7f6a1986","name":"Behavioral Detection of DLL Injection via Windows API","url":"https://attack.mitre.org/detectionstrategies/DET0389","analytics":[{"id":"AN1095","stix_id":"x-mitre-analytic--a06e9154-5584-4f5d-be47-b420d79674c7","name":"Analytic 1095","description":"Detects DLL injection through correlation of memory allocation and writing to remote process memory (e.g., VirtualAllocEx, WriteProcessMemory), followed by remote thread creation (e.g., CreateRemoteThread) that loads a suspicious or unsigned DLL using LoadLibrary or reflective loading.","url":"https://attack.mitre.org/detectionstrategies/DET0389#AN1095","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=17","data_component":"DC0048","data_component_name":"Named Pipe Metadata","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"InjectedDLLSignatureStatus","description":"Whether the DLL is unsigned, untrusted, or loaded from a non-standard path"},{"field":"TimeWindow","description":"Temporal correlation threshold between memory operations and thread creation"},{"field":"TargetProcessList","description":"List of sensitive or high-value processes targeted for injection (e.g., explorer.exe, winlogon.exe)"},{"field":"ParentProcessAnomalyThreshold","description":"Degree of deviation from expected parent-child lineage"}],"live":true,"detection_strategies":["DET0389"],"techniques":["T1055.001"]}],"live":true,"version":"1.0","techniques":["T1055.001"]}],"sigma_rules":[{"id":"052ec6f6-1adc-41e6-907a-f1c813478bee","title":"CreateRemoteThread API and LoadLibrary","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"medium","date":"2019-08-11","modified":"2024-01-22","description":"Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process","references":["https://threathunterplaybook.com/hunts/windows/180719-DLLProcessInjectionCreateRemoteThread/notebook.html"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_loadlibrary.yml","techniques":["T1055.001"],"cves":[]},{"id":"148431ce-4b70-403d-8525-fcc2993f29ea","title":"Potential DLL Injection Or Execution Using Tracker.exe","author":"Avneet Singh @v3t0_, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2023-01-09","description":"Detects potential DLL injection and execution using \"Tracker.exe\"","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml","techniques":["T1055.001"],"cves":[]},{"id":"340a090b-c4e9-412e-bb36-b4b16fe96f9b","title":"Renamed ZOHO Dctask64 Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-01-28","modified":"2025-01-22","description":"Detects a renamed \"dctask64.exe\" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.\nThis binary can be abused for DLL injection, arbitrary command and process execution.\n","references":["https://twitter.com/gN3mes1s/status/1222088214581825540","https://twitter.com/gN3mes1s/status/1222095963789111296","https://twitter.com/gN3mes1s/status/1222095371175911424"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1036","attack.t1055.001","attack.t1202","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml","techniques":["T1036","T1055.001","T1202","T1218"],"cves":[]},{"id":"4f73421b-5a0b-4bbf-a892-5a7fb99bea66","title":"Mavinject Inject DLL Into Running Process","author":"frack113, Florian Roth","status":"test","level":"high","date":"2021-07-12","modified":"2022-12-05","description":"Detects process injection using the signed Windows tool \"Mavinject\" via the \"INJECTRUNNING\" flag","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md","https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e","https://twitter.com/gN3mes1s/status/941315826107510784","https://reaqta.com/2017/12/mavinject-microsoft-injector/","https://twitter.com/Hexacorn/status/776122138063409152","https://github.com/SigmaHQ/sigma/issues/3742","https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001","attack.t1218.013"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml","techniques":["T1055.001","T1218.013"],"cves":[]},{"id":"6309645e-122d-4c5b-bb2b-22e4f9c2fa42","title":"HackTool - Potential CobaltStrike Process Injection","author":"Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community","status":"test","level":"high","date":"2018-11-30","modified":"2023-05-05","description":"Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons","references":["https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f","https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml","techniques":["T1055.001"],"cves":[]},{"id":"6345b048-8441-43a7-9bed-541133633d7a","title":"ManageEngine Endpoint Central Dctask64.EXE Potential Abuse","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-01-28","modified":"2025-01-22","description":"Detects the execution of \"dctask64.exe\", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.\nThis binary can be abused for DLL injection, arbitrary command and process execution.\n","references":["https://twitter.com/gN3mes1s/status/1222088214581825540","https://twitter.com/gN3mes1s/status/1222095963789111296","https://twitter.com/gN3mes1s/status/1222095371175911424"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001"],"path":"rules/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml","techniques":["T1055.001"],"cves":[]},{"id":"d1aa3382-abab-446f-96ea-4de52908210b","title":"TAIDOOR RAT DLL Load","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-07-30","modified":"2021-11-27","description":"Detects specific process characteristics of Chinese TAIDOOR RAT malware load","references":["https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.stealth","attack.t1055.001","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/TAIDOOR-RAT/proc_creation_win_apt_taidoor.yml","techniques":["T1055.001"],"cves":[]},{"id":"e6474a1b-5390-49cd-ab41-8d88655f7394","title":"Renamed Mavinject.EXE Execution","author":"frack113, Florian Roth","status":"test","level":"high","date":"2022-12-05","modified":"2023-02-03","description":"Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md","https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e","https://twitter.com/gN3mes1s/status/941315826107510784","https://reaqta.com/2017/12/mavinject-microsoft-injector/","https://twitter.com/Hexacorn/status/776122138063409152","https://github.com/SigmaHQ/sigma/issues/3742","https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001","attack.t1218.013"],"path":"rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml","techniques":["T1055.001","T1218.013"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2015-5119","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}