MITRE ATT&CK Technique
T1055Process Injection
- First Reported
- Mar 2, 2021
- Latest Reported
- Nov 6, 2026
Official Description
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific.
More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.
There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific.
More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.
- Tactics
- Stealth, Privilege Escalation
- Platforms
- Linux, macOS, Windows
- MITRE Version
- 2.0
- Last Modified
- Sep 11, 2026
Sub-techniques (12)
T1055.001 · Dynamic-link Library InjectionT1055.002 · Portable Executable InjectionT1055.003 · Thread Execution HijackingT1055.004 · Asynchronous Procedure CallT1055.005 · Thread Local StorageT1055.008 · Ptrace System CallsT1055.009 · Proc MemoryT1055.011 · Extra Window Memory InjectionT1055.012 · Process HollowingT1055.013 · Process Doppelgänging
Reported Context (243)
- The loader injects payloads into legitimate processes, including RegAsm.exe in Mode2. Fake GitHub Security Tools Deliver Backdoors and Infostealers
- The payload overwrites code in a loaded Windows DLL, which the article describes as module stomping. Fake Marvell RAID Utility Uses Signed MSBuild to Load Malware
- The downloaded payload is copied into a hidden cmd.exe process and started there. Signed Windows Utility Loader Delivers GodRAT Through Process Injection
- The downloaded payload is injected into svchost.exe. Yoba Campaign Uses Fake ChatGPT and Claude Apps to Deliver Crypto Miners
- The rsshd tool injects KeyDrift's PolyFlame module into vdaemon processes. Cisco SD-WAN Flaw Exploited to Deploy Malware Designed to Steal Traffic Encryption Keys
CVE (93)
Malware (471)
People (126)
Threat Actors (199)
MITRE ATT&CK (304)
Vendors (138)
Products (575)
Tools (359)
Industries (124)
Countries (102)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.