thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Process Injection

An ATT&CK technique (T1055) in which malware executes code within the address space of another process.

Definition

Process injection lets attackers evade defenses and possibly elevate privileges by running inside trusted processes. Sub-techniques include DLL injection, process hollowing, thread execution hijacking and APC injection. Suspicious cross-process memory writes and threads are key detection signals.

Example

Process hollowing that starts svchost.exe suspended and replaces its memory with a malicious image.

Exam tip

A trusted process with unexpected network connections may host injected code.

Related terms