skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-t1055-process-injection-with-sysmon

Detects T1055 process injection techniques by analyzing Sysmon events for cross-process memory operations.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#siem#sysmon#sigma#process injection#t1055
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-t1055-process-injection-with-sysmon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-t1055-process-injection-with-sysmon
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-t1055-process-injection-with-sysmon
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-t1055-process-injection-with-sysmon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams struggle to detect process injection attacks where malware hides inside legitimate processes like svchost.exe or explorer.exe. This Skill provides a structured hunting methodology with ready-to-use detection queries to identify DLL injection, process hollowing, and APC injection from Sysmon telemetry.

Core Features & Use Cases

  • Multi-Event Correlation: Combines Sysmon Events 8 (CreateRemoteThread), 10 (ProcessAccess), 7 (ImageLoaded), and 25 (ProcessTampering) to catch different injection variants.
  • Ready Detection Queries: Includes Splunk SPL, KQL, and Sigma rules targeting remote thread creation and suspicious cross-process access masks.
  • Gap Analysis: Documents detection blind spots such as reflective DLL injection and thread hijacking, with fallback approaches like pe-sieve memory scanning.
  • Use Case: After an EDR alert for suspicious cross-process memory access, use this Skill to hunt for the full injection chain, classify the ATT&CK sub-technique, and produce a structured hunt report.

Quick Start

Use this skill to hunt for process injection activity on hosts where Sysmon flagged remote thread creation into svchost.exe.

Frequently Asked Questions about detecting-t1055-process-injection-with-sysmon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect process injection with Sysmon?▼

Monitor Sysmon Event 8 for CreateRemoteThread calls between processes, Event 10 for cross-process access with write permissions like 0x0020, and Event 25 for process tampering. Correlate these with process creation events to build the full attack chain.

What Sysmon events detect DLL injection and process hollowing?▼

Event 8 catches classic DLL injection via CreateRemoteThread, Event 7 reveals anomalous DLL loads from unusual paths, and Event 25 (Sysmon 13+) detects process hollowing when the in-memory image diverges from disk.

Can Sysmon detect reflective DLL injection or APC injection?▼

Not directly. Reflective injection loads code without an Event 7 disk image, and APC injection never calls CreateRemoteThread. Use Event 10 access mask monitoring plus memory scanners like pe-sieve or Moneta as fallbacks.

Why does my Sysmon config miss process injection alerts?▼

Many shipped Sysmon configs filter out Event 8 entirely, and Event 25 requires Sysmon version 13 or later. Verify your configuration captures Events 1, 7, 8, 10, and 25, then validate with Atomic Red Team tests T1055.001 and T1055.002.

How do I reduce false positives in process injection detection?▼

Exclude legitimate cross-process activity by signed SourceImage such as AV products, debuggers, and RMM agents. Never exclude by target process, since attackers deliberately choose common targets like svchost.exe and explorer.exe.

Related Skills

Explore More Software Engineering Skills→
AxxxxxxaaannAxxxxxxaaann

analyzing-windows-event-logs-in-splunk

Analyze Windows event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Community
Advanced
mgreen27mgreen27

memory-analysis

Execute Volatility 3 plugins to analyze Windows memory images for malicious processes.

Community
Intermediate
dreadnodedreadnode
11

process-injection-hunt

Detect code injection techniques in Windows memory dumps via Volatility plugins.

Official
Intermediate
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced