detecting-process-injection-techniques

name	detecting-process-injection-techniques
description	Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware","process-injection","detection","memory-forensics","defense-evasion"]
version	1.0.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]
mitre_attack	["T1027","T1055","T1140","T1497","T1070"]

Detecting Process Injection Techniques

When to Use

• EDR alerts on suspicious API call sequences (VirtualAllocEx + WriteProcessMemory + CreateRemoteThread)
• A legitimate process (explorer.exe, svchost.exe) exhibits unexpected network connections or file operations
• Memory forensics reveals executable code in memory regions that should not contain it
• Investigating living-off-the-land attacks where malware hides inside trusted processes
• Building detection logic for specific injection techniques in EDR or SIEM rules

Do not use for standard DLL loading analysis; injection implies unauthorized code placement in a process without that process's cooperation.

Prerequisites

• Volatility 3 for memory forensics analysis of injection artifacts
• Sysmon configured with Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess)
• API Monitor or x64dbg for observing injection API calls in real-time
• Process Hacker or Process Explorer for inspecting process memory regions
• Understanding of Windows memory management (VirtualAlloc, VAD, page protections)
• Isolated analysis environment for safe malware execution and monitoring

Workflow

Step 1: Identify Injection via Memory Forensics

Use Volatility to detect injected code in process memory:

# malfind: Primary injection detection plugin
vol3 -f memory.dmp windows.malfind

# malfind detects:
# - Memory regions with PAGE_EXECUTE_READWRITE (RWX) protection
# - PE headers (MZ signature) in non-image VAD entries
# - Executable memory not backed by a file on disk

# Filter by specific process
vol3 -f memory.dmp windows.malfind --pid 852

# Dump injected memory regions for analysis
vol3 -f memory.dmp windows.malfind --dump

# Check VAD (Virtual Address Descriptor) tree for anomalies
vol3 -f memory.dmp windows.vadinfo --pid 852

# Detect hollowed processes (mapped image doesn't match disk)
vol3 -f memory.dmp windows.hollowfind

Step 2: Classify the Injection Technique

Identify which injection method was used based on artifacts:

Process Injection Techniques and Detection Artifacts:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Classic DLL Injection
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread
   Artifact: Loaded DLL in target process not present in known-good baseline
   Detection: New DLL in dlllist not matching disk hash, CreateRemoteThread event

2. Process Hollowing (RunPE)
   APIs: CreateProcess(SUSPENDED) -> NtUnmapViewOfSection -> VirtualAllocEx ->
         WriteProcessMemory -> SetThreadContext -> ResumeThread
   Artifact: Process image in memory doesn't match file on disk
   Detection: hollowfind plugin, mismatched PE headers vs disk file

3. APC Injection
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> QueueUserAPC
   Artifact: Alertable thread has queued APC pointing to injected code
   Detection: Thread start addresses outside known modules

4. Thread Hijacking
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory ->
         SuspendThread -> GetThreadContext -> SetThreadContext -> ResumeThread
   Artifact: Thread instruction pointer changed to injected code
   Detection: Thread context modification, EIP/RIP outside module boundaries

5. Reflective DLL Injection
   APIs: VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread (to reflective loader)
   Artifact: DLL loaded in memory but NOT in loaded module list
   Detection: malfind (PE in non-image memory), module not in ldrmodules

6. Process Doppelganging
   APIs: NtCreateTransaction -> NtCreateFile(transacted) -> NtWriteFile ->
         NtCreateSection -> NtRollbackTransaction -> NtCreateProcessEx
   Artifact: Process created from transacted file that was rolled back
   Detection: Process with no corresponding file on disk

7. AtomBombing
   APIs: GlobalAddAtom -> NtQueueApcThread (with GlobalGetAtomName)
   Artifact: Code stored in global atom table, APC triggers copy to target
   Detection: Unusual atom table entries, APC injection indicators