What attackers do. Attackers inject code into the memory of another running process so it runs under that process's identity. This helps hide activity inside trusted processes and can grant extra privileges, serving Defence Evasion and Privilege Escalation.
How to defend. Rely on endpoint detection that monitors memory and cross-process behaviour, since injection rarely leaves files on disk. Enable platform protections such as protected processes for security-sensitive services and attack surface reduction rules. Limit admin rights, which many injection methods require for system processes.
Signs to look for. Look for one process opening handles to another with write or thread creation rights, executable memory regions without a backing file, and normally quiet system processes making network connections. A common gap is that legitimate software also injects, so tuning is needed to avoid alert fatigue.