Skip to content
λmaldev wiki/
pagesProcess Injection

Process Injection

Getting code to execute inside a process you do not own. Ordered roughly from foundational to bleeding-edge, each with a working sample and matching detection logic.

14 techniques
T1055
Atom Bombing
Abuse the Windows global atom table to write shellcode into a target process and execute it via an APC queue.
T1055
Pool Party Injection
Abuse undocumented Windows thread pool work items to execute code in a remote process without CreateRemoteThread or QueueUserAPC.
T1055
Process Ghosting
Write a payload to a pending-delete file so Windows maps it into memory before the file is gone.
T1055.001
Classic DLL Injection
LoadLibrary in a remote thread. Trivially detected, but the baseline every other technique is measured against.
T1055.002
Module Stomping
Overwrite the .text section of a benign loaded DLL so your code sits in backed memory.
T1055.002
PE Injection
Allocate memory in a target process, write a full PE image into it, resolve its imports, and execute it — without writing a file to disk.
T1055.003
Thread Execution Hijacking
Suspend an existing thread, rewrite its context, point it at your shellcode.
T1055.004
APC Injection
Queue a user-mode APC onto an alertable thread and wait for it to drain.
T1055.004
Early Bird APC Injection
Queue a shellcode APC to a freshly created suspended process before its first instruction runs.
T1055.008
ptrace Injection
Attach to a live process on Linux and write shellcode straight into its address space.
T1055.012
Process Hollowing
Replace the image of a suspended process before it ever executes.
T1055.013
Process Doppelgänging
Abuse NTFS transactions so the on-disk image never matches what runs.
T1574.002
DLL Side-Loading
Drop a malicious DLL beside a legitimate signed application that loads it by relative path, inheriting the application's trust and execution context.
T1620
Reflective DLL Loading
A DLL that maps itself — no LoadLibrary, no module list entry.