{"id":"T1055","name":"Process Injection","url":"https://attack.mitre.org/techniques/T1055","tactics":["stealth","privilege-escalation"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0508","stix_id":"x-mitre-detection-strategy--9833b57b-4c83-4f58-b4cf-76f041b29273","name":"Behavioral Detection of Process Injection Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0508","analytics":[{"id":"AN1399","stix_id":"x-mitre-analytic--337976cc-5fd5-49e8-abcb-79f27d19382c","name":"Analytic 1399","description":"Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.","url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1399","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"etw:Microsoft-Windows-Kernel-Process","channel":"API calls","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-microsoft-windows-kernel-process"}],"mutable_elements":[{"field":"AccessMask","description":"Specific access rights used during process handle acquisition, e.g., PROCESS_VM_WRITE"},{"field":"TimeWindow","description":"Time correlation window between API calls and thread creation events"},{"field":"InjectedProcessList","description":"Known high-value targets often abused for injection (e.g., lsass.exe, explorer.exe)"}],"live":true,"detection_strategies":["DET0508"],"techniques":["T1055"]},{"id":"AN1400","stix_id":"x-mitre-analytic--61282e0a-3eae-4358-8821-6c8318961e24","name":"Analytic 1400","description":"Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.","url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1400","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"ptrace, mmap, process_vm_writev","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"linux:procfs","channel":"/proc/[pid]/maps, /proc/[pid]/mem","data_component":"DC0020","data_component_name":"Process Modification","log_source_slug":"linux-procfs"}],"mutable_elements":[{"field":"TargetPIDThreshold","description":"Limit to sensitive or unexpected processes being targeted (e.g., sshd, init)"},{"field":"TimeWindow","description":"Correlate mmap or writev usage to process access within a short timeframe"}],"live":true,"detection_strategies":["DET0508"],"techniques":["T1055"]},{"id":"AN1401","stix_id":"x-mitre-analytic--5439d083-91d6-4369-9406-8cfb2cf5cbde","name":"Analytic 1401","description":"Detects memory-based injection by monitoring `task_for_pid`, `mach_vm_write`, and dylib injection patterns through `DYLD_INSERT_LIBRARIES` or manual memory mapping.","url":"https://attack.mitre.org/detectionstrategies/DET0508#AN1401","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"subsystem=com.apple.security, library=libsystem_kernel.dylib","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"macos-endpointsecurity"},{"name":"macos:syslog","channel":"DYLD_INSERT_LIBRARIES anomalies","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"macos-syslog"}],"mutable_elements":[{"field":"TargetProcessSignature","description":"Expected signing identity or origin of process being injected"},{"field":"MachSyscallContext","description":"Observed syscall combinations (e.g., task_for_pid followed by vm_write)"}],"live":true,"detection_strategies":["DET0508"],"techniques":["T1055"]}],"live":true,"version":"1.0","techniques":["T1055"]}],"sigma_rules":[{"id":"02d1d718-dd13-41af-989d-ea85c7fab93f","title":"Rare Remote Thread Creation By Uncommon Source Image","author":"Perez Diego (@darkquassar), oscd.community","status":"test","level":"high","date":"2019-10-27","modified":"2025-12-08","description":"Detects uncommon processes creating remote threads.","references":["Personal research, statistical analysis","https://lolbas-project.github.io"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml","techniques":["T1055"],"cves":[]},{"id":"0e7163d4-9e19-4fa7-9be6-000c61aad77a","title":"CobaltStrike Named Pipe Pattern Regex","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-07-30","modified":"2026-06-18","description":"Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles","references":["https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575","https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml","techniques":["T1055"],"cves":[]},{"id":"0fa66f66-e3f6-4a9c-93f8-4f2610b00171","title":"Potential DLL Sideloading Using Coregen.exe","author":"frack113","status":"test","level":"medium","date":"2022-12-31","modified":null,"description":"Detect usage of the \"coregen.exe\" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Coregen/"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1218","attack.t1055"],"path":"rules/windows/image_load/image_load_side_load_coregen.yml","techniques":["T1218","T1055"],"cves":[]},{"id":"16b37b70-6fcf-4814-a092-c36bd3aafcbd","title":"PowerShell ShellCode","author":"David Ledbetter (shellcode), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2018-11-17","modified":"2024-01-25","description":"Detects Base64 encoded Shellcode","references":["https://twitter.com/cyb3rops/status/1063072865992523776"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml","techniques":["T1055","T1059.001"],"cves":[]},{"id":"16c37b52-b141-42a5-a3ea-bbe098444397","title":"Suspect Svchost Activity","author":"David Burkett, @signalblur","status":"test","level":"high","date":"2019-12-28","modified":"2022-06-27","description":"It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.","references":["https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_svchost_execution_with_no_cli_flags.yml","techniques":["T1055"],"cves":[]},{"id":"19b3806e-46f2-4b4c-9337-e3d8653245ea","title":"Lummac Stealer Activity - Execution Of More.com And Vbc.exe","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"experimental","level":"high","date":"2024-12-19","modified":null,"description":"Detects the execution of more.com and vbc.exe in the process tree.\nThis behavior was observed by a set of samples related to Lummac Stealer.\nThe Lummac payload is injected into the vbc.exe process.\n","references":["https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files","https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef","https://strontic.github.io/xcyclopedia/library/more.com-EDB3046610020EE614B5B81B0439895E.html","https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/Lummac-Stealer/proc_creation_win_malware_lummac_more_vbc.yml","techniques":["T1055"],"cves":[]},{"id":"1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd","title":"Suspicious Rundll32 Invoking Inline VBScript","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-03-05","modified":"2022-10-09","description":"Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452","references":["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_inline_vbs.yml","techniques":["T1055"],"cves":[]},{"id":"250ae82f-736e-4844-a68b-0b5e8cc887da","title":"Potential Shellcode Injection","author":"Bhabesh Raj","status":"test","level":"medium","date":"2022-03-11","modified":"2024-07-02","description":"Detects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.","references":["https://github.com/EmpireProject/PSInject"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_access/proc_access_win_susp_potential_shellcode_injection.yml","techniques":["T1055"],"cves":[]},{"id":"33a2d1dd-f3b0-40bd-8baf-7974468927cc","title":"APT PRIVATELOG Image Load Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-09-07","modified":"2022-10-09","description":"Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances","references":["https://web.archive.org/web/20210901184449/https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","detection.emerging-threats"],"path":"rules-emerging-threats/2021/TA/PRIVATELOG/image_load_usp_svchost_clfsw32.yml","techniques":["T1055"],"cves":[]},{"id":"396f6630-f3ac-44e3-bfc8-1b161bc00c4e","title":"Suspicious Child Process Of Wermgr.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-10-14","modified":"2024-08-29","description":"Detects suspicious Windows Error Reporting manager (wermgr.exe) child process","references":["https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html","https://www.echotrail.io/insights/search/wermgr.exe","https://github.com/binderlabs/DirCreate2System"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml","techniques":["T1055","T1036"],"cves":[]},{"id":"3c1b5fb0-c72f-45ba-abd1-4d4c353144ab","title":"Process Creation Using Sysnative Folder","author":"Max Altgelt (Nextron Systems)","status":"test","level":"medium","date":"2022-08-23","modified":"2025-10-08","description":"Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)","references":["https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_susp_sysnative.yml","techniques":["T1055"],"cves":[]},{"id":"409f8a98-4496-4aaa-818a-c931c0a8b832","title":"Created Files by Microsoft Sync Center","author":"elhoim","status":"test","level":"medium","date":"2022-04-28","modified":"2022-06-02","description":"This rule detects suspicious files created by Microsoft Sync Center (mobsync)","references":["https://redcanary.com/blog/intelligence-insights-november-2021/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.t1218","attack.execution"],"path":"rules/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml","techniques":["T1055","T1218"],"cves":[]},{"id":"4508a70e-97ef-4300-b62b-ff27992990ea","title":"DotNet CLR DLL Loaded By Scripting Applications","author":"omkar72, oscd.community","status":"test","level":"high","date":"2020-10-14","modified":"2023-02-23","description":"Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.","references":["https://github.com/tyranid/DotNetToJScript","https://thewover.github.io/Introducing-Donut/","https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html","https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml","techniques":["T1055"],"cves":[]},{"id":"4d0083b3-580b-40da-9bba-626c19fe4033","title":"HackTool - CoercedPotato Named Pipe Creation","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-10-11","modified":null,"description":"Detects the pattern of a pipe name as used by the hack tool CoercedPotato","references":["https://blog.hackvens.fr/articles/CoercedPotato.html","https://github.com/hackvens/CoercedPotato"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml","techniques":["T1055"],"cves":[]},{"id":"637f689e-b4a5-4a86-be0e-0100a0a33ba2","title":"HackTool - EfsPotato Named Pipe Creation","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2023-12-21","description":"Detects the pattern of a pipe name as used by the hack tool EfsPotato","references":["https://twitter.com/SBousseaden/status/1429530155291193354?s=20","https://github.com/zcgonvh/EfsPotato"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/pipe_created/pipe_created_hktl_efspotato.yml","techniques":["T1055"],"cves":[]},{"id":"66d31e5f-52d6-40a4-9615-002d3789a119","title":"Remote Thread Creation By Uncommon Source Image","author":"Perez Diego (@darkquassar), oscd.community","status":"test","level":"medium","date":"2019-10-27","modified":"2025-07-08","description":"Detects uncommon processes creating remote threads.","references":["Personal research, statistical analysis","https://lolbas-project.github.io"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml","techniques":["T1055"],"cves":[]},{"id":"6fe1719e-ecdf-4caf-bffe-4f501cb0a561","title":"Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection","author":"Sittikorn S, Nuttakorn T, Tim Shelton","status":"stable","level":"critical","date":"2021-07-01","modified":"2023-10-23","description":"Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .","references":["https://twitter.com/mvelazco/status/1410291741241102338","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527"],"logsource":{"category":"antivirus"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","detection.emerging-threats","cve.2021-34527","cve.2021-1675"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-1675/av_exploit_cve_2021_34527_print_nightmare.yml","techniques":["T1055"],"cves":["CVE-2021-34527","CVE-2021-1675"]},{"id":"71158e3f-df67-472b-930e-7d287acaa3e1","title":"Execution Of Non-Existing File","author":"Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2021-12-09","modified":"2026-07-05","description":"Detects process creation events where the Image field lacks an absolute path,\nwhich occurs when the backing file no longer exists on disk at the time of\nlogging - commonly caused by Process Ghosting or other unorthodox process creation techniques.\n","references":["https://pentestlaboratories.com/2021/12/08/process-ghosting/","https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.privilege-escalation","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_susp_image_missing.yml","techniques":["T1055"],"cves":[]},{"id":"744a188b-0415-4792-896f-11ddb0588dbc","title":"Potential Process Injection Via Msra.EXE","author":"Alexander McDonald","status":"test","level":"high","date":"2022-06-24","modified":"2023-02-03","description":"Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics","references":["https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/","https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_msra_process_injection.yml","techniques":["T1055"],"cves":[]},{"id":"85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7","title":"CobaltStrike Named Pipe Patterns","author":"Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-07-30","modified":"2024-01-26","description":"Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles","references":["https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575","https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","stp.1k"],"path":"rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml","techniques":["T1055"],"cves":[]},{"id":"89e1490f-1a3e-452a-bbb8-b68a5f58072f","title":"Injected Browser Process Spawning Rundll32 - GuLoader Activity","author":"@kostastsale","status":"test","level":"high","date":"2023-08-07","modified":null,"description":"Detects the execution of installed GuLoader malware on the host.\nGuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.\n","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/GuLoader/proc_creation_win_malware_guloader_execution.yml","techniques":["T1055"],"cves":[]},{"id":"9b4e7c2a-3f6d-4a8b-b5e9-1c7d3f2e6a4b","title":"RedSun - Named Pipe Created","author":"Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost","status":"experimental","level":"critical","date":"2026-04-17","modified":null,"description":"Detects the creation of a named pipe with the hardcoded name \"REDSUN\".\nThe RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain.\nRedSun creates the pipe as \\\\??\\pipe\\REDSUN.\nThe pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM.\nPresence of this pipe name indicates active or recent RedSun execution.\n","references":["https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591","https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.privilege-escalation","attack.stealth","attack.defense-impairment","attack.t1055","attack.t1685","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Exploits/RedSun/pipe_created_win_exploit_redsun_named_pipe.yml","techniques":["T1055","T1685"],"cves":[]},{"id":"9f2cc74d-78af-4eb2-bb64-9cd1d292b87b","title":"Microsoft Sync Center Suspicious Network Connections","author":"elhoim","status":"test","level":"medium","date":"2022-04-28","modified":"2024-03-12","description":"Detects suspicious connections from Microsoft Sync Center to non-private IPs.","references":["https://redcanary.com/blog/intelligence-insights-november-2021/"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.t1218","attack.execution"],"path":"rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml","techniques":["T1055","T1218"],"cves":[]},{"id":"a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c","title":"RedSun - TieringEngineService.exe Detected as EICAR Test File","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"critical","date":"2026-04-17","modified":null,"description":"Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe\ndropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present.\nThis covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based\nAV bypass/privilege escalation tool.\n\nRedSun works as follows:\n  1. Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\\RS-{GUID}\\\n  2. The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger\n     a Defender scan and remediation attempt\n  3. Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file\n  4. When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open\n  5. During the oplock break window, RedSun swaps the mount point (junction) to redirect\n     \\\\?\\C:\\Windows\\System32 to the attacker-controlled temp path\n  6. This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges\n","references":["https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L605","https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html"],"logsource":{"product":"windows","service":"windefend"},"tags":["attack.stealth","attack.defense-impairment","attack.t1036.005","attack.t1685","attack.privilege-escalation","attack.t1055","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Exploits/RedSun/win_defender_exploit_redsun_tiering_engine_detected_as_eicar.yml","techniques":["T1036.005","T1685","T1055"],"cves":[]},{"id":"a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f","title":"Remote Thread Created In Shell Application","author":"Splunk Research Team","status":"test","level":"medium","date":"2024-07-29","modified":"2025-07-04","description":"Detects remote thread creation in command shell applications, such as \"Cmd.EXE\" and \"PowerShell.EXE\".\nIt is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.\n","references":["https://research.splunk.com/endpoint/10399c1e-f51e-11eb-b920-acde48001122/","https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","detection.threat-hunting"],"path":"rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml","techniques":["T1055"],"cves":[]},{"id":"b655a06a-31c0-477a-95c2-3726b83d649d","title":"Suspicious Userinit Child Process","author":"Florian Roth (Nextron Systems), Samir Bousseaden (idea)","status":"test","level":"medium","date":"2019-06-17","modified":"2025-10-17","description":"Detects a suspicious child process of userinit","references":["https://twitter.com/SBousseaden/status/1139811587760562176"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_susp_userinit_child.yml","techniques":["T1055"],"cves":[]},{"id":"b7967e22-3d7e-409b-9ed5-cdae3f9243a1","title":"Malware Shellcode in Verclsid Target Process","author":"John Lambert (tech), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-03-04","modified":"2021-11-27","description":"Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro","references":["https://twitter.com/JohnLaTwC/status/837743453039534080"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/Hancitor/proc_access_win_malware_verclsid_shellcode.yml","techniques":["T1055"],"cves":[]},{"id":"bafd07c6-3ea5-454a-b4be-058fbb073de7","title":"Potential Executable Run Itself As Sacrificial Process","author":"frack113","status":"experimental","level":"low","date":"2025-10-17","modified":null,"description":"Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion.\nInvestigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries.\nReview command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.\n","references":["https://www.joesandbox.com/analysis/1605063/0/html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_parent_execute_itself.yml","techniques":["T1055"],"cves":[]},{"id":"d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47","title":"Suspicious Cross-User Process Spawn","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-07-23","modified":null,"description":"Detects suspicious spawning of a process under a different user context than the parent process.\nProcesses such as notepad.exe, calculator etc. are generally spawned under the same user context and\nalso they are often targeted as sacrificial process or decoy process to check successful privilege escalation.\n","references":["https://github.com/MSNightmare/LegacyHive","https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.t1134"],"path":"rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn.yml","techniques":["T1055","T1134"],"cves":[]},{"id":"d5601f8c-b26f-4ab0-9035-69e11a8d4ad2","title":"CobaltStrike Named Pipe","author":"Florian Roth (Nextron Systems), Wojciech Lesicki","status":"test","level":"critical","date":"2021-05-25","modified":"2022-10-31","description":"Detects the creation of a named pipe as used by CobaltStrike","references":["https://twitter.com/d4rksystem/status/1357010969264873472","https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/","https://github.com/SigmaHQ/sigma/issues/253","https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/","https://redcanary.com/threat-detection-report/threats/cobalt-strike/"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml","techniques":["T1055"],"cves":[]},{"id":"d78b5d61-187d-44b6-bf02-93486a80de5a","title":"HackTool - DInjector PowerShell Cradle Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-12-07","modified":"2023-02-04","description":"Detects the use of the Dinject PowerShell cradle based on the specific flags","references":["https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_hktl_dinjector.yml","techniques":["T1055"],"cves":[]},{"id":"e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e","title":"Potential Dridex Activity","author":"Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"stable","level":"critical","date":"2019-01-10","modified":"2023-02-03","description":"Detects potential Dridex acitvity via specific process patterns","references":["https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3","https://redcanary.com/threat-detection-report/threats/dridex/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.discovery","attack.t1135","attack.t1033","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Dridex/proc_creation_win_malware_dridex.yml","techniques":["T1055","T1135","T1033"],"cves":[]},{"id":"e7888eb1-13b0-4616-bd99-4bc0c2b054b9","title":"Dllhost.EXE Execution Anomaly","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-27","modified":"2023-05-15","description":"Detects a \"dllhost\" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.","references":["https://redcanary.com/blog/child-processes/","https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08","https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml","techniques":["T1055"],"cves":[]},{"id":"e81528db-fc02-45e8-8e98-4e84aba1f10b","title":"Network Connection Initiated Via Notepad.EXE","author":"EagleEye Team","status":"test","level":"high","date":"2020-05-14","modified":"2024-02-02","description":"Detects a network connection that is initiated by the \"notepad.exe\" process.\nThis might be a sign of process injection from a beacon process or something similar.\nNotepad rarely initiates a network communication except when printing documents for example.\n","references":["https://web.archive.org/web/20200219102749/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf","https://www.cobaltstrike.com/blog/why-is-notepad-exe-connecting-to-the-internet"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.privilege-escalation","attack.command-and-control","attack.execution","attack.stealth","attack.t1055"],"path":"rules/windows/network_connection/net_connection_win_notepad.yml","techniques":["T1055"],"cves":[]},{"id":"e8d34729-86a4-4140-adfd-0a29c2106307","title":"HackTool - CoercedPotato Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-10-11","modified":"2024-11-23","description":"Detects the use of CoercedPotato, a tool for privilege escalation","references":["https://github.com/hackvens/CoercedPotato","https://blog.hackvens.fr/articles/CoercedPotato.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml","techniques":["T1055"],"cves":[]},{"id":"f17211f1-1f24-4d0c-829f-31e28dc93cdd","title":"Uncommon Svchost Command Line Parameter","author":"Liran Ravich","status":"experimental","level":"high","date":"2025-11-14","modified":"2026-03-23","description":"Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.\nThis could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.\n","references":["https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/","https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware","https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/","https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1036.005","attack.t1055","attack.t1055.012"],"path":"rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml","techniques":["T1036.005","T1055","T1055.012"],"cves":[]},{"id":"fe3ac066-98bb-432a-b1e7-a5229cb39d4a","title":"Malicious Named Pipe Created","author":"Florian Roth (Nextron Systems), blueteam0ps, elhoim","status":"test","level":"critical","date":"2017-11-06","modified":"2023-08-07","description":"Detects the creation of a named pipe seen used by known APTs or malware.","references":["https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/","https://securelist.com/faq-the-projectsauron-apt/75533/","https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf","https://www.us-cert.gov/ncas/alerts/TA17-117A","https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html","https://thedfirreport.com/2020/06/21/snatch-ransomware/","https://github.com/RiccardoAncarani/LiquidSnake","https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity","https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a","https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf","https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/","https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"path":"rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml","techniques":["T1055"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-25257","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-21480","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-56145","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-6047","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-58136","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-31324","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-1316","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-24993","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-25181","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-22224","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-34192","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-0108","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-40891","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-40890","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-21418","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-29574","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-50603","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-0282","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-6548","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}