domains / families / security / detecting-t1055-process-injection-with-sysmon

detecting-t1055-process-injection-with-sysmon

separate

Detect process injection techniques (T1055) - including DLL injection, process

When to use

• When hunting for defense evasion techniques that hide malicious code inside legitimate processes
• After EDR alerts for suspicious cross-process memory access or remote thread creation
• When investigating malware that injects into svchost.exe, explorer.exe, or other system processes
• During purple team exercises testing detection of process injection variants
• When validating Sysmon configuration coverage for injection detection

Skill page

Source