Process Injection
Getting code to execute inside a process you do not own. Ordered roughly from foundational to bleeding-edge, each with a working sample and matching detection logic.
8 techniques
T1055.001Windows06-02T1055.002Windows06-30T1055.003Windows07-04T1055.004Windows05-19T1055.008Linux06-11T1055.012Windows07-21T1055.013Windows07-09T1620Windows07-12
Classic DLL Injection
LoadLibrary in a remote thread. Trivially detected, but the baseline every other technique is measured against.
Module Stomping
Overwrite the .text section of a benign loaded DLL so your code sits in backed memory.
Thread Execution Hijacking
Suspend an existing thread, rewrite its context, point it at your shellcode.
APC Injection
Queue a user-mode APC onto an alertable thread and wait for it to drain.
ptrace Injection
Attach to a live process on Linux and write shellcode straight into its address space.
Process Hollowing
Replace the image of a suspended process before it ever executes.
Process Doppelgänging
Abuse NTFS transactions so the on-disk image never matches what runs.
Reflective DLL Loading
A DLL that maps itself — no LoadLibrary, no module list entry.
no techniques match those filters.