skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-process-injection-techniques

Detect process injection techniques via Sysmon Event IDs 8 and 10 and EDR telemetry.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#sysmon#edr#process injection#t1055#dll injection
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-process-injection-techniques
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-process-injection-techniques
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-process-injection-techniques
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-process-injection-techniques

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC analysts and threat hunters struggle to reliably detect process injection (MITRE ATT&CK T1055) because many techniques evade common telemetry, and legitimate processes like AV and debuggers generate heavy false positive noise.

Core Features & Use Cases

  • Sysmon Event Analysis: Parses Event IDs 1, 8, and 10 to flag CreateRemoteThread calls and dangerous ProcessAccess masks such as PROCESS_VM_WRITE and PROCESS_CREATE_THREAD.
  • Evasion-Aware Detection: Documents gaps where thread hijacking, APC injection, mapping injection, and process hollowing bypass Event ID 8, and explains how to corroborate with Event ID 7 and ETW.
  • Severity Scoring & Reporting: Builds source-to-target injection relationship graphs, filters known legitimate pairs, and produces JSON reports mapped to MITRE sub-techniques T1055.001 through T1055.012.
  • Use Case: A SOC analyst investigating a suspected intrusion runs this hunt against exported Sysmon JSON logs to identify unsigned processes opening high-access handles into critical targets like lsass.exe.

Quick Start

Hunt for process injection activity in my exported Sysmon JSON logs and generate a severity-scored report mapped to MITRE ATT&CK T1055 sub-techniques.

Frequently Asked Questions about hunting-for-process-injection-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect process injection with Sysmon?▼

Enable Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess), then flag suspicious source-target process pairs and dangerous access masks like PROCESS_VM_WRITE and PROCESS_CREATE_THREAD. Filter known legitimate injectors such as AV and debuggers by signer to reduce noise.

What Sysmon Event IDs detect CreateRemoteThread and DLL injection?▼

Event ID 8 logs CreateRemoteThread calls directly, while Event ID 10 logs ProcessAccess events with access masks like 0x1F0FFF that indicate injection attempts. Event ID 7 (ImageLoad) helps corroborate unbacked module loads from injection.

Which process injection techniques bypass Sysmon Event ID 8?▼

Thread hijacking via SetThreadContext, APC injection via QueueUserAPC, mapping injection via NtMapViewOfSection, and process hollowing all skip CreateRemoteThread. These surface only as Event ID 10 ProcessAccess events with VM write or thread creation access rights.

How do I reduce false positives in process injection detection?▼

Allowlist known injector-to-target pairs such as MsMpEng.exe and vmtoolsd by signer rather than image name. Treat read-only access masks like 0x1000 and 0x1400 as benign, and focus on cross-process opens from unsigned or unusual sources.

How do I validate that process injection detection rules fire correctly?▼

Run Atomic Red Team tests for T1055.001 (process hollowing), T1055.002, and mavinject.exe APC injection, then confirm Event ID 8 GrantedAccess values and Event ID 10 access masks appear in your collected telemetry.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-webshell-activity

Detect webshell deployments by analyzing process creation, network, and web access logs.

Official
Advanced
coreymaypraycoreymaypray
1

threat-detection-engineer

Author Sigma detection rules with MITRE ATT&CK mapping for SIEM deployment.

Community
Advanced
lNwNllNwNl
2

windows-av-evasion

Implement Windows AV/EDR evasion workflows for AMSI bypass and ETW telemetry reduction.

Community
Advanced
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced