Technique
№ 045 · class: evasion
Process Injection
Injecting malicious code into the address space of a legitimate process.
Term
description · examples · notesInjecting malicious code into the address space of a legitimate process.
Description
Includes DLL injection, process hollowing, thread hijacking, and APC injection.
Malicious code executes under the identity of the legitimate process.
Bypasses application whitelisting and process controls.
Requires appropriate privileges over the target process.
Examples
- Process hollowing — replacing legitimate process content with malware
- DLL injection into explorer.exe for persistent access
Notes
- Differs from DLL sideloading: injection is at runtime, sideloading is at startup.
Threats
used by 3Threats that use it. Select one to open its page.
Defenses
countered by 5How it is countered. Select one to open its page.