MalteiroG1026 ↗
tfMITRE ATT&CK sub-technique
Dynamic-link Library Injection T1055.001
sub-technique of T1055 Process Injection
- Tactics
- Privilege Escalation, Stealth
- Platform
- Windows
- Version
- 2.0
- Created
- 14 January 2020
- Last modified
- 12 May 2026
- Contributor
- Boominathan Sundaram
Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
10
Threat groupsTop 19%
Threat groups81st percentile · 81% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.56
Tools & malwareTop 7%
Tools & malware93rd percentile · 93% of ATT&CK techniques have this many tools implementing them or fewer.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Dynamic-link Library Injection MITRE reference T1055.001
Top 19%of all ATT&CK techniques for number of groups
10 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
BackdoorDiplomacyG0135 ↗
Has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.1
Wizard SpiderG0102 ↗
Has injected malicious DLLs into memory with read, write, and execute permissions.12
KimsukyG0094 ↗
Has the ability to load DLLs via reflective injection by allocating memory using VirtualAllocEx(), then decrypting a DLL with WriteProcessMemory() and invoking execution through CreateRemoteThread().1
TA505G0092 ↗
Has been seen injecting a DLL into winword.exe.1
Tropic TrooperG0081 ↗
Has injected a DLL backdoor into dllhost.exe and svchost.exe.12
All 10 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0015C0015 ↗
During C0015, the threat actors used a DLL named D8B3.dll that was injected into the Winlogon process.1
All 1 campaigns for this technique
56 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QilinS1242 ↗
Can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.1
TONESHELLS1239 ↗
Has used DLL injection to execute payloads received from the C2 server.1
HavocS1229 ↗
Has DLL spawn and injection modules.1
SagerunexS1210 ↗
Is designed to be dynamic link library (DLL) injected into an infected endpoint and executed directly in memory.1
BADHATCHS1081 ↗
Has the ability to execute a malicious DLL by injecting into explorer.exe on a compromised machine.1
DarkTortillaS1066 ↗
Can use a .NET-based DLL named RunPe6 for process injection.1
All 56 software entries for this technique · 6 newest in this preview
Offense vs defense T1055.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 4
first rule: 2018 Q4 · 1 of 1 campaigns plottedDynamic-link Library Injection detection strategy DET0389
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of DLL Injection via Windows API
1 platform
AN1095 · Windows
Detects DLL injection through correlation of memory allocation and writing to remote process memory (e.g., VirtualAllocEx, WriteProcessMemory), followed by remote thread creation (e.g., CreateRemoteThread) that loads a suspicious or unsigned DLL using LoadLibrary or reflective loading.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Named Pipe MetadataDC0048 | WinEventLog:Sysmon | EventCode=17 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InjectedDLLSignatureStatus | Whether the DLL is unsigned, untrusted, or loaded from a non-standard path |
| TimeWindow | Temporal correlation threshold between memory operations and thread creation |
| TargetProcessList | List of sensitive or high-value processes targeted for injection (e.g., explorer.exe, winlogon.exe) |
| ParentProcessAnomalyThreshold | Degree of deviation from expected parent-child lineage |
2 analytics
Microsoft Windows allows for processes to remotely create threads within other processes of the same privilege level. This functionality is provided via the Windows API CreateRemoteThread. Both Windows and third-party software use this ability for legitimate purposes. For example, the Windows process csrss.exe creates threads in programs to send signals to registered callback routines. Both adversaries and host-based security software use this functionality to inject DLLs, but for very different purposes. An adversary is likely to inject into a program to evade defenses or bypass User Account Control, but a security program might do this to gain increased monitoring of API calls. One of the most common methods of DLL Injection is through the Windows API LoadLibrary.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-SCA | System Call Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| thread | remote_create | src_pid |
| thread | remote_create | start_function |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Search for remote thread creations that start at LoadLibraryA or LoadLibraryW. Depending on the tool, it may provide additional information about the DLL string that is an argument to the function. If there is any security software that legitimately injects DLLs, it must be carefully whitelisted.
remote_thread = search Thread:RemoteCreate remote_thread = filter (start_function == "LoadLibraryA" or start_function == "LoadLibraryW") remote_thread = filter (src_image_path != "C:\Path\To\TrustedProgram.exe") output remote_thread
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=8 start_function IN ["LoadLibraryA", "LoadLibraryW"] -source_image="C:\Path\To\TrustedProgram.exe"
Injecting a malicious DLL into a process is a common adversary TTP. Although the ways of doing this are numerous, mavinject.exe is a commonly used tool for doing so because it roles up many of the necessary steps into one, and is available within Windows. Attackers may rename the executable, so we also use the common argument "INJECTRUNNING" as a related signature here. Whitelisting certain applications may be necessary to reduce noise for this analytic.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process:Create mavinject_processes = filter processes where ( exe = "C:\\Windows\\SysWOW64\\mavinject.exe" OR Image="C:\\Windows\\System32\\mavinject.exe" OR command_line = "*/INJECTRUNNING*" output mavinject_processes
Search for instances of mavinject.exe or mavinject32.exe
(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Windows\\SysWOW64\\mavinject.exe" OR Image="C:\\Windows\\System32\\mavinject.exe" OR CommandLine="*\INJECTRUNNING*")
Search for instances of mavinject.exe or mavinject32.exe
norm_id=WindowsSysmon event_id=1 (image="C:\Windows\SysWOW64\mavinject.exe" OR image="C:\Windows\System32\mavinject.exe" OR command="*\INJECTRUNNING*")
Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.
Tests2ExecutorsPowerShell 2Need elevation1 of 2Have prerequisites1Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition