attack.t1055

FlawedGrace spawning threat injection target

Mar 18, 2025 · attack.defense-evasion attack.t1055 dist.public ·

Detecting the command FlawedGrace is using for the purpose of injecting into it the spawned process, in this case the cmd.exe process.

Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Jan 30, 2025 · attack.defense-evasion attack.t1055 detection.emerging-threats ·

Share on:

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

HackTool - CoercedPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

HackTool - DInjector PowerShell Cradle Execution

Sep 13, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Injected Browser Process Spawning Rundll32 - GuLoader Activity

Sep 2, 2024 · attack.defense-evasion attack.t1055 detection.emerging-threats ·

Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Potential DLL Sideloading Using Coregen.exe

Aug 29, 2024 · attack.defense-evasion attack.t1218 attack.t1055 ·

Share on:

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Suspicious Child Process Of Wermgr.EXE

Aug 29, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·

Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Aug 12, 2024 · attack.privilege-escalation attack.t1055 ·

Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

APT PRIVATELOG Image Load Pattern

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·

Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

CobaltStrike Named Pipe

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe as used by CobaltStrike

CobaltStrike Named Pipe Pattern Regex

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

CobaltStrike Named Pipe Patterns

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 stp.1k ·

Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Created Files by Microsoft Sync Center

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·

Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Dllhost.EXE Execution Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

DotNet CLR DLL Loaded By Scripting Applications

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1055 ·

Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Malicious Named Pipe Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe seen used by known APTs or malware.

Malware Shellcode in Verclsid Target Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·

Share on:

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

Microsoft Sync Center Suspicious Network Connections

Aug 12, 2024 · attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·

Share on:

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Network Connection Initiated Via Notepad.EXE

Aug 12, 2024 · attack.command-and-control attack.execution attack.defense-evasion attack.t1055 ·

Share on:

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

Potential Dridex Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging-threats ·

Share on:

Detects potential Dridex acitvity via specific process patterns

Potential Process Injection Via Msra.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

PowerShell ShellCode

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.execution attack.t1059.001 ·

Share on:

Detects Base64 encoded Shellcode

Process Creation Using Sysnative Folder

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Rare Remote Thread Creation By Uncommon Source Image

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·

Share on:

Detects uncommon processes creating remote threads.

Remote Thread Created In Shell Application

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.

Remote Thread Creation By Uncommon Source Image

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·

Share on:

Detects uncommon processes creating remote threads.

Suspect Svchost Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Suspicious Rundll32 Invoking Inline VBScript

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

Suspicious Userinit Child Process

Aug 12, 2024 · attack.defense-evasion attack.t1055 ·

Share on:

Detects a suspicious child process of userinit

Injected Browser Process Spawning Rundll32

Aug 10, 2024 · attack.defense_evasion attack.T1055 ·

Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Rundll32 Injection into LSASS

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.t1055 ·

Share on:

The following pseudo-detector should help security teams detect instances where Rundll32 opens a cross process handle into LSASS to collect credentials. Part of the RedCanary 2024 Threat Detection Report.

Network Connections Where There Should Not Be (Notepad)

Sep 1, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for network connections from notepad. Inspired by the 2022 Red Canary Threat Detection report.

Powershell Injecting Into Anything (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects instances of PowerShell accessing any other processes. Part of the RedCanary 2023 Threat Detection Report.

Process Executing Sans Command Line (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects processes running without command lines, which can indicate process injection. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Network Connections (RedCanary Threat Detection Report)

May 10, 2023 · attack.privilege_escalation attack.t1055 ·

Share on:

Detects notepad making network connections, a potential process injection signal. Part of the RedCanary 2023 Threat Detection Report.

PowerShell Injecting into Other Process

Nov 9, 2022 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for process access activity where PowerShell is accessing any other processes. Inspired by the 2022 Red Canary Threat Detection report.

Process Execution sans Command Lines

Nov 9, 2022 · attack.privilege_escalation attack.t1055 ·

Share on:

Looks for process execution with no command line arguments, which may indicate process injection. Inspired by the 2022 Red Canary Threat Detection report.