Log in Request a demo

Attack technique

Process Injection

Process injection is when an attacker runs their own code inside another program that is already running.

In short

Process injection is when an attacker runs their own code inside another program that is already running. The code then borrows the identity of that program. This can help it avoid security tools and, in some cases, gain more access.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact
  1. MITRE IDT1055ATT&CK technique
  2. Detection4ways to spot itMemory and thread activity · System call logs on Linux
  3. Defences2ways to stop it

How it works

Every running program has its own memory space. In process injection, the attacker finds a way to place and run code inside the memory of a different, live process.

Running inside another process can give access to that process’s memory, system and network resources, and sometimes higher privileges. Security products may also miss the activity, because it appears to come from a legitimate program.

There are many ways to do this, and many abuse normal features of the system. They exist for every major operating system but are usually specific to one. MITRE lists a dozen sub-techniques, such as process hollowing. More advanced malware may inject into several processes and let them talk to each other.

MITRE lists 12 sub-techniques: T1055.001 Dynamic-link Library Injection; T1055.002 Portable Executable Injection; T1055.003 Thread Execution Hijacking; T1055.004 Asynchronous Procedure Call; T1055.005 Thread Local Storage; T1055.008 Ptrace System Calls; T1055.009 Proc Memory; T1055.011 Extra Window Memory Injection; T1055.012 Process Hollowing; T1055.013 Process Doppelgänging; T1055.014 VDSO Hijacking; T1055.015 ListPlanting.

A real example

Procedure examples listed by MITRE ATT&CK:

  • ABK can inject shellcode into svchost.exe.
  • ANDROMEDA can inject into the wuauclt.exe process to carry out command and control actions.
  • Backdoor.Oldrea injects itself into explorer.exe.
  • Agent Tesla can inject into known, vulnerable binaries on targeted hosts.
  • APT32 is listed by MITRE ATT&CK as having injected a Cobalt Strike beacon into Rundll32.exe.

How to detect

  1. Memory and thread activity

    Correlate calls that change another process's memory with the creation of unusual threads and unexpected library loads in that process.

  2. System call logs on Linux

    Use audit logs to see system calls that target running processes, along with suspicious file descriptors or memory writes.

  3. Memory access on macOS

    Monitor for one process reaching into another process's memory, and for libraries forced into a program.

  4. Detection strategy MITRE lists

    DET0508, Behavioral Detection of Process Injection Across Platforms.

How to defend

  1. Behavior prevention on endpoints

    Configure endpoint security to block behavior sequences common in injection. On Windows 10, attack surface reduction rules can stop Office applications from injecting code.

  2. Limit debugging access on Linux

    Restrict ptrace to privileged users, and use access control modules such as SELinux or AppArmor to limit what processes can do.

Questions

What is process injection?

Process injection is when an attacker runs their own code inside the memory of another program that is already running. The code then borrows the identity of that program, which can help it avoid security tools.

Why do attackers use process injection?

Running inside another process can give access to that process's memory, system and network resources, and sometimes higher privileges. Security products may also miss the activity because it appears to come from a legitimate program.

How can process injection be detected?

Correlate calls that change another process's memory with the creation of unusual threads and unexpected library loads. On Linux, audit logs show system calls that target running processes. On macOS, watch for one process reaching into another's memory.

How do I defend against process injection?

Configure endpoint security to block behavior sequences common in injection. On Windows 10, attack surface reduction rules can stop Office applications from injecting code. On Linux, restrict ptrace to privileged users and use SELinux or AppArmor.

In our research

  1. GC01 (Golden Chickens): Inside the Arsenal of a Premier E-Crime MaaS Provider April 2026
  2. [Research Summary]: Rugmi Loader August 2024
  3. Xehook Stealer Technical Analysis June 2024
  4. [Research Summary]: Snatch Ransomware December 2023
  5. [Research Summary]: Stop/Djvu Ransomware October 2023
  6. Most Common Attack Vectors & Ransomware Threat Relation October 2022

Sources

  1. MITRE ATT&CK T1055: Process Injection MITRE
  2. MITRE ATT&CK T1055.012: Process Injection: Process Hollowing MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Article

[Research Summary]: Rugmi Loader

Rugmi loader technical analysis: phishing delivery, DLL hijacking, direct syscalls, Heaven's Gate evasion, process injection, a stealer payload and defenses

Read more

Threat group

APT37

MITRE ATT&CK describes APT37, also called ScarCruft, as a North Korean state-sponsored cyber espionage group that has been active since at least 2012. It targets South Korea first, using spearphishing emails with Hangul (HWP) attachments, compromised websites and cloud services for control. No government advisory opened names the group itself.

Read more

Glossary term

Privilege escalation

Privilege escalation is when an attacker gains higher-level permissions than they started with.

Read more