← Techniques
T1055.004 ↑ T1055Process Injection Defined ATT&CK T1055.004 ↗

Process Injection: Asynchronous Procedure Call

Process Write ProcessSegment — Write shellcode into a target process's address space and execute it by queueing an Asynchronous Procedure Call to an alertable thread via QueueUserAPC.

Ontological Definition
T1055 parent:Process→Write→ProcessSegment
ActorProcess
→
ActionWrite
→
ArtifactProcessSegment
[
constrains
api.name = QueueUserAPC
]

Detect

STP 3

api.name is not OCSF native. Kernel-mode APC telemetry (ETW Microsoft-Windows-Kernel-Process) is required; user-mode QueueUserAPC events are not surfaced by Sysmon. STP 3 until the OCSF api.name extension is available and kernel telemetry sources implement it.

Gate on
activity_id = Inject
api.name = QueueUserAPC

APC injection to a running thread does not spawn a visible thread. Gate on kernel-mode APC queue events where source and target PIDs differ, filtered to suspicious process relationships. This variant is harder to detect than CreateRemoteThread (T1055.001) with standard Sysmon telemetry.

Mitigate

STP 5

ACG/CIG operate at the kernel level against the ProcessSegment write — they cannot be bypassed by switching injection primitive.

Enable ACG and Code Integrity Guard (CIG). These controls are technique-level — they apply to all T1055 sub-techniques regardless of injection primitive.

Respond

Controlled

The target process now executes attacker-controlled code. Kill the injector process and the compromised target immediately. Investigate all files, network connections, and child processes they spawned.

Attacker foothold
Injector Processactor.process
Injection Primitiveapi
Compromised by this technique
Target Processprocess
D3FEND response actions
d3f:ProcessTerminationd3f:NetworkIsolation
OCSF event model▼

Event class: Process Activity (1007)  ·  activity_id: Inject

attacker-controlledpost-successvictimtainted
%%{init: {"theme": "dark", "themeVariables": {"edgeLabelBackground": "#18181b", "lineColor": "#52525b"}}}%%
graph TD
  classDef attacker fill:#7c2d12,stroke:#ea580c,color:#fed7aa
  classDef victim fill:#1e3a5f,stroke:#3b82f6,color:#bfdbfe
  classDef postSuccess fill:#78350f,stroke:#d97706,color:#fde68a
  classDef tainted fill:#18181b,stroke:#52525b,color:#a1a1aa

  EVENT(["Process Activity\n· Inject"])

  actor_process["Injector Process\nactor.process\nd3f:Process"]:::attacker
  target_process["Target Process\nprocess\nd3f:Process"]:::postSuccess
  injection_api["Injection Primitive\napi\nd3f:SystemCall"]:::attacker
  device["Host\ndevice\nd3f:Host\n⚠ tainted"]:::tainted

  EVENT --> actor_process
  EVENT --> target_process
  EVENT --> injection_api
  EVENT --> device

  actor_process -.->|"injects into"| target_process
Injector Process
actor.process·d3f:Process
attacker-controlled
actor.process.file.pathattacker_controlledInjector binary path — attacker-chosen, easily changed
Countermeasures
d3f:ProcessTermination
Target Process
process·d3f:Process
post-success
process.pidvariableTarget process identifier — OS-assigned, varies per execution
Countermeasures
d3f:ProcessTermination
Injection Primitive
api·d3f:SystemCall
attacker-controlled
api.nameinvariant= QueueUserAPC
Host
device·d3f:Host
tainted
Countermeasures
d3f:NetworkIsolation
Definitional Sigma rule▼

Broad by design — defines the technique, not an operational alert. Gate on variable or attacker-controlled field conditions to narrow for production use.

title: Process Injection: Asynchronous Procedure Call (T1055.004)
status: experimental
description: >
  Definitional rule — broad by design. Defines the technique independent of
  medium, tool, or attacker-controlled variables. Narrow with variable and
  attacker-controlled field conditions for operational use.
logsource:
  product: ocsf
  category: Process Activity (1007)
detection:
  selection:
    activity_id: 'Inject'
    api.name: 'QueueUserAPC'
  condition: selection