AN1095
Analytic 1095
Windows
Detects DLL injection through correlation of memory allocation and writing to remote process memory (e.g., VirtualAllocEx, WriteProcessMemory), followed by remote thread creation (e.g., CreateRemoteThread) that loads a suspicious or unsigned DLL using LoadLibrary or reflective loading.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=17
[InjectedDLLSignatureStatus]
Whether the DLL is unsigned, untrusted, or loaded from a non-standard path
[TimeWindow]
Temporal correlation threshold between memory operations and thread creation
[TargetProcessList]
List of sensitive or high-value processes targeted for injection (e.g., explorer.exe, winlogon.exe)
[ParentProcessAnomalyThreshold]
Degree of deviation from expected parent-child lineage