proc-injctn-tchnqs-1f7a

Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.

Ir para a instalação

Repositório: Undermybelt/hermes-skills
Última atividade na origem: 7 de junho de 2026 às 07:23
Idioma detectado do SKILL.md: inglês
Estrelas: 6
Forks: 1

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/Undermybelt/hermes-skills --skill proc-injctn-tchnqs-1f7a

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

4 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

anti-entropy-governance

Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.

2026-06-07

brainstorming

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

2026-06-07

communicating-concisely

Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.

2026-06-07

Ver todas deste repositório

name	proc-injctn-tchnqs-1f7a
description	Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware","process-injection","detection","memory-forensics","defense-evasion"]
version	1.0.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Detecting Process Injection Techniques

When to Use

EDR alerts on suspicious API call sequences (VirtualAllocEx + WriteProcessMemory + CreateRemoteThread)
A legitimate process (explorer.exe, svchost.exe) exhibits unexpected network connections or file operations
Memory forensics reveals executable code in memory regions that should not contain it
Investigating living-off-the-land attacks where malware hides inside trusted processes
Building detection logic for specific injection techniques in EDR or SIEM rules

Do not use for standard DLL loading analysis; injection implies unauthorized code placement in a process without that process's cooperation.

Prerequisites

Volatility 3 for memory forensics analysis of injection artifacts
Sysmon configured with Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess)
API Monitor or x64dbg for observing injection API calls in real-time
Process Hacker or Process Explorer for inspecting process memory regions
Understanding of Windows memory management (VirtualAlloc, VAD, page protections)
Isolated analysis environment for safe malware execution and monitoring

Workflow

Step 1: Identify Injection via Memory Forensics

Use Volatility to detect injected code in process memory:

# malfind: Primary injection detection plugin
vol3 -f memory.dmp windows.malfind

# malfind detects:
# - Memory regions with PAGE_EXECUTE_READWRITE (RWX) protection
# - PE headers (MZ signature) in non-image VAD entries
# - Executable memory not backed by a file on disk

# Filter by specific process
vol3 -f memory.dmp windows.malfind --pid 852

# Dump injected memory regions for analysis
vol3 -f memory.dmp windows.malfind --dump

# Check VAD (Virtual Address Descriptor) tree for anomalies
vol3 -f memory.dmp windows.vadinfo --pid 852

# Detect hollowed processes (mapped image doesn't match disk)
vol3 -f memory.dmp windows.hollowfind

Step 2: Classify the Injection Technique

Identify which injection method was used based on artifacts:

Process Injection Techniques and Detection Artifacts:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Classic DLL Injection
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread
   Artifact: Loaded DLL in target process not present in known-good baseline
   Detection: New DLL in dlllist not matching disk hash, CreateRemoteThread event

2. Process Hollowing (RunPE)
   APIs: CreateProcess(SUSPENDED) -> NtUnmapViewOfSection -> VirtualAllocEx ->
         WriteProcessMemory -> SetThreadContext -> ResumeThread
   Artifact: Process image in memory doesn't match file on disk
   Detection: hollowfind plugin, mismatched PE headers vs disk file

3. APC Injection
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> QueueUserAPC
   Artifact: Alertable thread has queued APC pointing to injected code
   Detection: Thread start addresses outside known modules

4. Thread Hijacking
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory ->
         SuspendThread -> GetThreadContext -> SetThreadContext -> ResumeThread
   Artifact: Thread instruction pointer changed to injected code
   Detection: Thread context modification, EIP/RIP outside module boundaries

5. Reflective DLL Injection
   APIs: VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread (to reflective loader)
   Artifact: DLL loaded in memory but NOT in loaded module list
   Detection: malfind (PE in non-image memory), module not in ldrmodules

6. Process Doppelganging
   APIs: NtCreateTransaction -> NtCreateFile(transacted) -> NtWriteFile ->
         NtCreateSection -> NtRollbackTransaction -> NtCreateProcessEx
   Artifact: Process created from transacted file that was rolled back
   Detection: Process with no corresponding file on disk

7. AtomBombing
   APIs: GlobalAddAtom -> NtQueueApcThread (with GlobalGetAtomName)
   Artifact: Code stored in global atom table, APC triggers copy to target
   Detection: Unusual atom table entries, APC injection indicators

Term	Definition
Process Injection	Technique of executing code within the address space of another process, typically to evade detection and inherit the target's trust level
Process Hollowing	Creating a legitimate process in suspended state, unmapping its memory, writing malicious code, and resuming execution to masquerade as the legitimate process
Reflective DLL Injection	Loading a DLL into a process's memory without using the Windows loader, so the DLL does not appear in the loaded module list
APC Injection	Queuing an Asynchronous Procedure Call to a thread in the target process, causing it to execute injected code when the thread enters an alertable state
VAD (Virtual Address Descriptor)	Windows kernel structure describing memory regions in a process; anomalous VAD entries (RWX permissions, non-image PE) indicate injection
CreateRemoteThread	Windows API creating a thread in another process; the primary mechanism for classic DLL injection and many other injection techniques
PAGE_EXECUTE_READWRITE	Memory protection allowing read, write, and execute; rarely used by legitimate applications, common indicator of injected code

proc-injctn-tchnqs-1f7a

Opções de instalação

Revise os arquivos de origem

Detecting Process Injection Techniques

When to Use

Prerequisites

Workflow

Step 1: Identify Injection via Memory Forensics

Step 2: Classify the Injection Technique

Detecting Process Injection Techniques

When to Use

Prerequisites

Workflow

Step 1: Identify Injection via Memory Forensics

Step 2: Classify the Injection Technique

Step 3: Detect Injection via Sysmon Events

Step 4: Analyze Injected Code

Step 5: Map to MITRE ATT&CK

Step 6: Create Detection Signatures

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Investigating a Hollowed svchost.exe Process

Output Format

proc-injctn-tchnqs-1f7a

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

Detecting Process Injection Techniques

When to Use

Prerequisites

Workflow

Step 1: Identify Injection via Memory Forensics

Step 2: Classify the Injection Technique

Detecting Process Injection Techniques

When to Use

Prerequisites

Workflow

Step 1: Identify Injection via Memory Forensics

Step 2: Classify the Injection Technique

Step 3: Detect Injection via Sysmon Events

Step 4: Analyze Injected Code

Step 5: Map to MITRE ATT&CK

Step 6: Create Detection Signatures

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Investigating a Hollowed svchost.exe Process

Output Format