← Techniques
T1055.001 ↑ T1055Process Injection Defined ATT&CK T1055.001 ↗

Process Injection: DLL Injection

Process Write ProcessSegment — Write a DLL or shellcode into a target process's address space and execute it by spawning a remote thread via CreateRemoteThread.

Ontological Definition
T1055 parent:Process→Write→ProcessSegment
ActorProcess
→
ActionWrite
→
ArtifactProcessSegment
[
constrains
api.name = CreateRemoteThread
]

Detect

STP 3

api.name is not OCSF native — requires an extension. Without it, this sub-technique is indistinguishable from other injection variants at the event level. Practical detection via Sysmon EID 8 (CreateRemoteThread) uses source/target process relationship filters — STP 3, as the injection primitive is an attacker-chosen Execution Medium.

Gate on
activity_id = Inject
api.name = CreateRemoteThread

Until api.name is available in OCSF, use Sysmon Event ID 8 (CreateRemoteThread) with source/target process relationship filters. Suspicious cross-process thread creation (e.g. browser → system process) is the highest-signal pattern.

Mitigate

STP 5

ACG/CIG operate at the kernel level against the ProcessSegment write — they cannot be bypassed by switching injection primitive.

Enable ACG and Code Integrity Guard (CIG). These controls are technique-level — they apply to all T1055 sub-techniques regardless of injection primitive.

Respond

Controlled

The target process now executes attacker-controlled code. Kill the injector process and the compromised target immediately. Investigate all files, network connections, and child processes they spawned.

Attacker foothold
Injector Processactor.process
Injection Primitiveapi
Compromised by this technique
Target Processprocess
D3FEND response actions
d3f:ProcessTerminationd3f:NetworkIsolation
OCSF event model▼

Event class: Process Activity (1007)  ·  activity_id: Inject

attacker-controlledpost-successvictimtainted
%%{init: {"theme": "dark", "themeVariables": {"edgeLabelBackground": "#18181b", "lineColor": "#52525b"}}}%%
graph TD
  classDef attacker fill:#7c2d12,stroke:#ea580c,color:#fed7aa
  classDef victim fill:#1e3a5f,stroke:#3b82f6,color:#bfdbfe
  classDef postSuccess fill:#78350f,stroke:#d97706,color:#fde68a
  classDef tainted fill:#18181b,stroke:#52525b,color:#a1a1aa

  EVENT(["Process Activity\n· Inject"])

  actor_process["Injector Process\nactor.process\nd3f:Process"]:::attacker
  target_process["Target Process\nprocess\nd3f:Process"]:::postSuccess
  injection_api["Injection Primitive\napi\nd3f:SystemCall"]:::attacker
  device["Host\ndevice\nd3f:Host\n⚠ tainted"]:::tainted

  EVENT --> actor_process
  EVENT --> target_process
  EVENT --> injection_api
  EVENT --> device

  actor_process -.->|"injects into"| target_process
Injector Process
actor.process·d3f:Process
attacker-controlled
actor.process.file.pathattacker_controlledInjector binary path — attacker-chosen, easily changed
Countermeasures
d3f:ProcessTermination
Target Process
process·d3f:Process
post-success
process.pidvariableTarget process identifier — OS-assigned, varies per execution
Countermeasures
d3f:ProcessTermination
Injection Primitive
api·d3f:SystemCall
attacker-controlled
api.nameinvariant= CreateRemoteThread
Host
device·d3f:Host
tainted
Countermeasures
d3f:NetworkIsolation
Definitional Sigma rule▼

Broad by design — defines the technique, not an operational alert. Gate on variable or attacker-controlled field conditions to narrow for production use.

title: Process Injection: DLL Injection (T1055.001)
status: experimental
description: >
  Definitional rule — broad by design. Defines the technique independent of
  medium, tool, or attacker-controlled variables. Narrow with variable and
  attacker-controlled field conditions for operational use.
logsource:
  product: ocsf
  category: Process Activity (1007)
detection:
  selection:
    activity_id: 'Inject'
    api.name: 'CreateRemoteThread'
  condition: selection