Detects process injection (MITRE T1055) via Sysmon events 7,8,10,25 for DLL injection, process hollowing, APC, and more. Includes Splunk queries for threat hunting suspicious cross-process activity.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 狩猎将恶意代码隐藏在合法进程中的防御规避技术时
Detects process injection (T1055) like DLL injection, process hollowing, APC injection by analyzing Sysmon events 7,8,10,25 for cross-process ops and anomalous DLLs. For threat hunting after EDR alerts.
Detects T1055 process injection techniques like DLL injection, process hollowing, and APC injection via Sysmon events 1,7,8,10,25 for cross-process memory ops, remote threads, anomalous DLLs. For threat hunting.
Detects process injection techniques (MITRE T1055) via Sysmon events ID 8/10 and EDR telemetry, including CreateRemoteThread, process hollowing, and DLL injection for threat hunting.
Share bugs, ideas, or general feedback.
| 概念 | 描述 |
|---|---|
| T1055.001 | 动态链接库注入（DLL 注入） |
| T1055.002 | 可移植可执行文件注入（PE 注入） |
| T1055.003 | 线程执行劫持 |
| T1055.004 | 异步过程调用（APC）注入 |
| T1055.005 | 线程本地存储 |
| T1055.012 | 进程镂空（Process Hollowing） |
| T1055.013 | 进程替身（Process Doppelganging） |
| T1055.015 | ListPlanting |
| Sysmon 事件 8 | 检测到 CreateRemoteThread |
| Sysmon 事件 10 | 带内存写权限的 ProcessAccess |
| Sysmon 事件 25 | ProcessTampering（镜像不匹配） |
| 访问掩码 0x1FFFFF | PROCESS_ALL_ACCESS——完全跨进程控制 |
| 工具 | 用途 |
|---|---|
| Sysmon | 注入检测的主要遥测来源 |
| Process Hacker | 手动检查进程内存区域 |
| PE-sieve | 扫描运行中进程中的镂空/注入代码 |
| Moneta | 检测进程中的异常内存区域 |
| Splunk / Elastic | SIEM 关联 Sysmon 事件 |
| Volatility | 注入工件的内存取证 |
| Hollows Hunter | 自动扫描被镂空的进程 |
index=sysmon EventCode=8
| where SourceImage!=TargetImage
| where NOT match(SourceImage, "(?i)(csrss|lsass|services|svchost|MsMpEng|SecurityHealthService|vmtoolsd)\.exe$")
| eval suspicious=if(match(TargetImage, "(?i)(svchost|explorer|lsass|winlogon|csrss|services)\.exe$"), "high_value_target", "normal_target")
| where suspicious="high_value_target"
| table _time Computer SourceImage SourceProcessId TargetImage TargetProcessId StartFunction NewThreadId
index=sysmon EventCode=10
| where SourceImage!=TargetImage
| where match(GrantedAccess, "(0x1FFFFF|0x1F3FFF|0x143A|0x0040)")
| where match(TargetImage, "(?i)(lsass|svchost|explorer|winlogon)\.exe$")
| where NOT match(SourceImage, "(?i)(MsMpEng|csrss|services|svchost|taskmgr|procexp)\.exe$")
| table _time Computer SourceImage TargetImage GrantedAccess CallTrace
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "CreateRemoteThreadApiCall"
| where InitiatingProcessFileName !in~ ("csrss.exe", "lsass.exe", "services.exe", "svchost.exe")
| where FileName in~ ("svchost.exe", "explorer.exe", "lsass.exe", "winlogon.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine
title: Process Injection via CreateRemoteThread into System Process
status: stable
logsource:
product: windows
category: create_remote_thread
detection:
selection:
TargetImage|endswith:
- '\svchost.exe'
- '\explorer.exe'
- '\lsass.exe'
- '\winlogon.exe'
filter_legitimate:
SourceImage|endswith:
- '\csrss.exe'
- '\lsass.exe'
- '\services.exe'
- '\MsMpEng.exe'
condition: selection and not filter_legitimate
level: high
tags:
- attack.defense_evasion
- attack.t1055
Hunt ID: TH-INJECT-[DATE]-[SEQ]
Host: [主机名]
Source Process: [注入进程路径]
Source PID: [进程 ID]
Target Process: [目标进程路径]
Target PID: [进程 ID]
Injection Type: [DLL/Shellcode/Hollowing/APC]
Sysmon Events: [触发的事件 ID]
Access Mask: [授予的访问值]
Risk Level: [Critical/High/Medium/Low]
ATT&CK Sub-Technique: [T1055.xxx]