{"id":"T1055.015","name":"ListPlanting","url":"https://attack.mitre.org/techniques/T1055/015","tactics":["stealth","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0331","stix_id":"x-mitre-detection-strategy--175b97d9-287e-4ab6-ae95-8652c224f02a","name":"Detection Strategy for ListPlanting Injection on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0331","analytics":[{"id":"AN0941","stix_id":"x-mitre-analytic--217128c5-144d-492b-ab72-bd0704348221","name":"Analytic 0941","description":"Detects the use of message-based injection by monitoring for sequences involving FindWindow (EnumWindows or EnumChildWindows), VirtualAllocEx or related API calls, combined with suspicious PostMessage/SendMessage (e.g., LVM_SETITEMPOSITION) use to SysListView32 controls, followed by LVM_SORTITEMS invocation instead of WriteProcessMemory.","url":"https://attack.mitre.org/detectionstrategies/DET0331#AN0941","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=8","data_component":"DC0020","data_component_name":"Process Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"etw:Microsoft-Windows-Win32k","channel":"SendMessage, PostMessage, LVM_*","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-microsoft-windows-win32k"}],"mutable_elements":[{"field":"TimeWindow_PostMessage_to_LVM_SORTITEMS","description":"Defines temporal distance between payload copy and execution trigger"},{"field":"TargetWindowClassName","description":"Restrict detection to SysListView32 or similar GUI elements"},{"field":"UserContextAnomalyThreshold","description":"Adjusts detection sensitivity to users sending window messages across session boundaries"},{"field":"InterprocessWindowMessagingFrequency","description":"Raise alert when rate of message-passing to foreign GUI processes exceeds baseline"}],"live":true,"detection_strategies":["DET0331"],"techniques":["T1055.015"]}],"live":true,"version":"1.0","techniques":["T1055.015"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}