detecting-process-injection-techniques

name	detecting-process-injection-techniques
description	Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection. . Use when working with detecting process injection techniques.
domain	cybersecurity
tags	["malware","process-injection","detection","memory-forensics","defense-evasion"]
subdomain	malware-analysis
version	1.0.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Detecting Process Injection Techniques

Overview

Cybersecurity skill for detecting process injection techniques. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting process injection techniques"

• "Detects and analyzes process injection techniques used by malware including clas"

• EDR alerts on suspicious API call sequences (VirtualAllocEx + WriteProcessMemory + CreateRemoteThread)

• A legitimate process (explorer.exe, svchost.exe) exhibits unexpected network connections or file operations

• Memory forensics reveals executable code in memory regions that should not contain it

• Investigating living-off-the-land attacks where malware hides inside trusted processes

• Building detection logic for specific injection techniques in EDR or SIEM rules

Do not use for standard DLL loading analysis; injection implies unauthorized code placement in a process without that process's cooperation.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Volatility 3 for memory forensics analysis of injection artifacts
• Sysmon configured with Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess)
• API Monitor or x64dbg for observing injection API calls in real-time
• Process Hacker or Process Explorer for inspecting process memory regions
• Understanding of Windows memory management (VirtualAlloc, VAD, page protections)
• Isolated analysis environment for safe malware execution and monitoring

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs() -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}