Detecting Process Injection

Process injection is how malware hides in plain sight — it runs its code inside a legitimate process to inherit that process’s trust, evade process-based detection, and slip past application allowlists. Because the malicious code lives inside explorer.exe or a browser, you cannot detect it by looking for a bad process. You detect the act of injection: a remote thread created in another process, a handle opened with write-execute access, RWX memory allocated. This guide ships those signals and the Sigma rule that catches them.

Process injection maps to MITRE ATT&CK T1055 — Process Injection and its many sub-techniques (DLL injection, process hollowing, thread hijacking). It is a core defense-evasion step, and it depends on the same Sysmon telemetry as the rest of the Windows detection cluster.

What is process injection?

Process injection places attacker code into the memory of another, legitimate process and executes it there. The malware might allocate memory in a target process, write its payload, and start a thread to run it (classic DLL/shellcode injection); or carve out a legitimate process and replace its image (process hollowing); or hijack an existing thread. In every case the goal is the same: run as a trusted process to evade detection and inherit its privileges and network reputation.

That is why hunting for a malicious executable fails — there isn’t one running as itself. The reliable signals are the Windows API behaviors injection requires, which Sysmon surfaces as discrete events.

What does process injection look like in telemetry?

The unifying signal is one process reaching into another’s memory or threads. A source process that is not a debugger or security tool creating a remote thread in explorer.exe is injection — the discriminator is which source and which target.

How to detect process injection

The core rule flags a remote thread created in another process (Sysmon Event ID 8), allowlisting known-good source processes.

title: Remote Thread Created in Another Process
id: 6f2c9a41-darkpwn-illustrative
status: experimental
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    TargetImage|endswith: ['\explorer.exe','\svchost.exe','\lsass.exe','\winlogon.exe']
  filter_known:
    SourceImage|endswith: ['\MsMpEng.exe','\CSFalconService.exe']
  condition: selection and not filter_known
falsepositives:
  - Debuggers, security tools, and some installers (allowlist by SourceImage/signer)
level: high

How to test your process-injection detection

In an isolated VM you own:

1. Use a benign injection test (an Atomic Red Team T1055 test, or a lab tool that injects a harmless payload) and confirm Sysmon Event ID 8/10 fire.
2. Confirm your allowlisted security tools do not trip the rule.
3. Run a process-hollowing test and confirm Event ID 25 (process tampering) appears.
4. Verify the rule survives a renamed injector — it keys on the behavior, not the name.

How to reduce the process-injection attack surface

• Monitor EDR health — attackers inject after unhooking or disabling it via BYOVD.
• Collect the right Sysmon events (EID 8, 10, 25) — see Sysmon configuration.
• Baseline legitimate injectors so the allowlist is accurate.

Common process-injection detection mistakes

• Hunting for a bad process. There isn’t one — the code runs inside a good process.
• No CreateRemoteThread/ProcessAccess telemetry. Without EID 8/10, the act is invisible.
• No source-target allowlist. The rule pages on debuggers and security tools.
• Ignoring EDR tampering. Injection often follows the EDR being unhooked.

Process injection detection checklist

1. Collect Sysmon Event IDs 8 (remote thread), 10 (process access), and 25 (tampering).
2. Alert on remote threads/handles into system and high-value processes.
3. Allowlist legitimate injectors by SourceImage and code-signing certificate.
4. Correlate injection with the target’s subsequent network/credential activity.
5. Enable ASR rules blocking Office/script-host injection and child processes.
6. Run Credential Guard and WDAC to limit the payoff and the payload.
7. Monitor EDR health and driver loads (BYOVD precursor).
8. Test with Atomic Red Team T1055 and a renamed injector.

The takeaway

Detecting process injection means watching the act — CreateRemoteThread, write/execute handles, RWX memory, process tampering — from unexpected source processes, allowlisted to your real injectors, and chained to the payoff. You cannot find a bad process; find the injection. Continue with LSASS credential dumping detection and BYOVD detection, or browse the full Detection Engineering pillar.