process-injection-hunt

What problem does it solve?

This Skill solves the challenge of detecting stealthy code injection in running system processes, a common attacker technique that evades standard endpoint detection tools and requires deep memory analysis to identify.

Core Features & Use Cases

• Multi-technique injection detection: Covers classic RWX injection, reflective DLL loads, process hollowing, APC injection, thread hijacking, and manual mapping, aligned with MITRE ATT&CK T1055 process injection sub-techniques.
• Structured forensic workflow: Provides a step-by-step procedure using Volatility plugins to baseline with malfind, perform DLL list gap analysis, check for process hollowing, inspect thread activity, and analyze handles and named pipes.
• C2 framework pivoting: Includes quick checks for common command-and-control tools like Cobalt Strike, Brute Ratel, and Sliver, plus YARA rule integration to sweep for related artifacts across memory dumps and other hosts.
• False positive disambiguation: Explicit guidance to avoid misidentifying legitimate RWX regions from .NET JIT compilation, browser/Office JIT activity, and packed legitimate software.

Quick Start

Use the process-injection-hunt skill to analyze the memory image of the suspicious process flagged during triage and confirm whether it is hosting injected foreign code.