AN1399
Analytic 1399
Windows
Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
etw:Microsoft-Windows-Kernel-Process
API calls
[AccessMask]
Specific access rights used during process handle acquisition, e.g., PROCESS_VM_WRITE
[TimeWindow]
Time correlation window between API calls and thread creation events
[InjectedProcessList]
Known high-value targets often abused for injection (e.g., lsass.exe, explorer.exe)
AN1400
Analytic 1400
Linux
Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.
auditd:SYSCALL
ptrace, mmap, process_vm_writev
auditd:SYSCALL
open
linux:procfs
/proc/[pid]/maps, /proc/[pid]/mem
[TargetPIDThreshold]
Limit to sensitive or unexpected processes being targeted (e.g., sshd, init)
[TimeWindow]
Correlate mmap or writev usage to process access within a short timeframe
AN1401
Analytic 1401
macOS
Detects memory-based injection by monitoring `task_for_pid`, `mach_vm_write`, and dylib injection patterns through `DYLD_INSERT_LIBRARIES` or manual memory mapping.
macos:unifiedlog
subsystem=com.apple.security, library=libsystem_kernel.dylib
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP
macos:syslog
DYLD_INSERT_LIBRARIES anomalies
[TargetProcessSignature]
Expected signing identity or origin of process being injected
[MachSyscallContext]
Observed syscall combinations (e.g., task_for_pid followed by vm_write)