[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1055":3},{"item":4,"lessons":18,"controls":68,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1055","T1055","Process Injection",19,"MITRE","**What attackers do.** Attackers inject code into the memory of another running process so it runs under that process's identity. This helps hide activity inside trusted processes and can grant extra privileges, serving Defence Evasion and Privilege Escalation.\n\n**How to defend.** Rely on endpoint detection that monitors memory and cross-process behaviour, since injection rarely leaves files on disk. Enable platform protections such as protected processes for security-sensitive services and attack surface reduction rules. Limit admin rights, which many injection methods require for system processes.\n\n**Signs to look for.** Look for one process opening handles to another with write or thread creation rights, executable memory regions without a backing file, and normally quiet system processes making network connections. A common gap is that legitimate software also injects, so tuning is needed to avoid alert fatigue.","Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system\u002Fnetwork resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1055\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"peerstitch-malware-exploits-unpatched-fortios-to-evade-detection-via-legitimate-processes","PEERSTITCH Malware Exploits Unpatched FortiOS to Evade Detection via Legitimate Processes","2026-10-16T08:21:33.492+00:00",{"slug":25,"title":26,"published_at":27},"researchers-breach-windows-smartscreen-vbs-enclave-via-memory-write-and-timing-flaw","Researchers Breach Windows SmartScreen VBS Enclave via Memory Write and Timing Flaw","2026-10-14T08:21:27.74+00:00",{"slug":29,"title":30,"published_at":31},"clickfix-attack-abuses-browser-cache-to-smuggle-malicious-payloads","ClickFix Attack Abuses Browser Cache to Smuggle Malicious Payloads","2026-10-06T08:21:47.852+00:00",{"slug":33,"title":34,"published_at":35},"sectoprat-hides-in-legitimate-apps-evading-signature-detection","SectopRAT Hides in Legitimate Apps, Evading Signature Detection","2026-09-24T22:21:29.706+00:00",{"slug":37,"title":38,"published_at":39},"process-parameter-poisoning-bypasses-edr-detection","Process Parameter Poisoning Bypasses EDR Detection","2026-09-23T22:20:42.313+00:00",{"slug":41,"title":42,"published_at":43},"f5-big-ip-memory-injected-web-shell-evades-disk-based-detection","F5 BIG-IP Memory-Injected Web Shell Evades Disk-Based Detection","2026-09-09T10:21:59.938+00:00",{"slug":45,"title":46,"published_at":47},"linux-rootkit-exploits-unpatched-f5-big-ip-apm-flaw-to-achieve-fileless-persistence","Linux Rootkit Exploits Unpatched F5 BIG-IP APM Flaw to Achieve Fileless Persistence","2026-09-08T22:22:35.275+00:00",{"slug":49,"title":50,"published_at":51},"synkloader-multitool-signals-rising-ransomware-threat-via-screen-hijacking-malware","SynkLoader Multitool Signals Rising Ransomware Threat via Screen-Hijacking Malware","2026-08-24T16:20:34.049+00:00",{"slug":53,"title":54,"published_at":55},"grandoreiro-banking-trojan-returns-with-stronger-evasion-capabilities","Grandoreiro Banking Trojan Returns With Stronger Evasion Capabilities","2026-08-20T14:20:35.506+00:00",{"slug":57,"title":58,"published_at":59},"memory-resident-backdoors-octlurk-silklurk-target-central-asian-governments","Memory-Resident Backdoors OctLurk & SilkLurk Target Central Asian Governments","2026-07-30T12:20:40.699+00:00",{"slug":61,"title":62,"published_at":63},"fileless-phishing-campaign-bypasses-defenses-to-deploy-rats-and-stealers","Fileless Phishing Campaign Bypasses Defenses to Deploy RATs and Stealers","2026-07-20T20:20:23.783+00:00",{"slug":65,"title":66,"published_at":67},"linux-kernel-privilege-escalation-ai-evading-malware-and-active-exploitation-highlight-layered-threa","Linux Kernel Privilege Escalation, AI-Evading Malware, and Active Exploitation Highlight Layered Threat Landscape","2026-06-29T16:20:37.686+00:00",[69,73,78,83,88,92],{"slug":70,"name":71,"problem":72,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":74,"name":75,"problem":76,"stories":77},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",7,{"slug":79,"name":80,"problem":81,"stories":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,{"slug":84,"name":85,"problem":86,"stories":87},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",4,{"slug":89,"name":90,"problem":91,"stories":87},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":93,"name":94,"problem":95,"stories":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[97,103,109,114,119,123,127,132],{"family":98,"item":99,"code":100,"title":101,"together":102},"nist-800-53","si-3","SI-3","Malicious Code Protection",14,{"family":104,"item":105,"code":106,"title":107,"together":108},"cis","13","Control 13","Network Monitoring and Defense",10,{"family":110,"item":111,"code":112,"title":113,"together":108},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":104,"item":115,"code":116,"title":117,"together":118},"10","Control 10","Malware Defenses",9,{"family":120,"item":121,"code":122,"title":122,"together":77},"itil","overview","ITIL",{"family":104,"item":124,"code":125,"title":126,"together":77},"8","Control 8","Audit Log Management",{"family":104,"item":128,"code":129,"title":130,"together":131},"7","Control 7","Continuous Vulnerability Management",6,{"family":133,"item":134,"code":135,"title":136,"together":82},"gdpr","32","Article 32","Security of processing"]