Techniques › T1055.005 › AN1289
AN1289 Analytic 1289
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects thread local storage (TLS) callback injection by monitoring memory modifications to PE headers and TLS directory structures during or after process hollowing events, followed by anomalous thread behavior prior to main entry point execution.</p>
- Detects
- T1055.005 Thread Local Storage
- Part of
- DET0467 Detection Strategy for TLS Callback Injection via PE Memory Modification and Hollowing
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:Sysmon | EventCode=8 | DC0020 Process Modification |
| EDR:memory | MemoryWriteToExecutable | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TargetProcessFilter | Subset of processes whose TLS callbacks should not change post-load (e.g., explorer.exe, lsass.exe) |
TimeWindowBetweenLoadAndTLSModification | Acceptable delay between image load and memory tampering in .tls or .data sections |
AnomalousThreadStartThreshold | Number of threads executing prior to main entry point that is considered suspicious |
PayloadEntropyThreshold | Optional threshold to distinguish injected shellcode from benign memory writes |