CyberStack

MITRE ATT&CK / Techniques / T1055

Process Injection

ID
T1055
Tactics
TA0004 Privilege Escalation, TA0005 Stealth
Platforms
Linux, macOS, Windows
Data sources
Process Access, Process Creation, Module Load, OS API Execution, File Access, Process Modification, Process Metadata
Source
attack.mitre.org
MITRE last modified
12 Sep 2026

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific.

More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Sub-techniques (12)

Detection

Mitigations (2)

M1026 Privileged Account Management

Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurity, and AppArmor.

M1040 Behavior Prevention on Endpoint

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection. [1]

Groups (15)

Software (66)

Showing 60 of 66. Full list on attack.mitre.org.

References

  1. win10_asr