メニュー
Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1055-002-portable-executable-injectionコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | T1055.002_portable-executable-injection |
| description | Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1055.002","defense-evasion","privilege-escalation","windows","sub-technique"] |
| technique_id | T1055.002 |
| tactic | defense-evasion |
| all_tactics |
| ["defense-evasion","privilege-escalation"] |
| platforms | ["Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1055/002 |
| tech_stack | ["windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1055","T1055.001","T1055.003","T1055.004","T1055.005","T1055.008","T1055.009","T1055.011","T1055.012","T1055.013","T1055.014","T1055.015"] |
| prerequisites | ["T1055"] |
| severity_boost | {"T1055":"Chain with T1055 for deeper attack path","T1055.001":"Chain with T1055.001 for deeper attack path","T1055.003":"Chain with T1055.003 for deeper attack path"} |
Sub-technique of: T1055
Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.
PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
This test injects a portable executable into a remote Notepad process memory using Portable Executable Injection and base-address relocation techniques. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds.
Supported Platforms: windows Elevation Required: Yes
Start-Process "#{exe_binary}"
Start-Sleep -Seconds 7
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Portable Executable Injection by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1055.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.
| Finding | Severity | Impact |
|---|---|---|
| Portable Executable Injection technique applicable | High | Defense Evasion |
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |