RockeG0106 ↗
Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.1
tfMITRE ATT&CK sub-technique
Portable Executable Injection T1055.002
sub-technique of T1055 Process Injection
- Tactics
- Privilege Escalation, Stealth
- Platform
- Windows
- Version
- 2.0
- Created
- 14 January 2020
- Last modified
- 12 May 2026
Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.12
Tools & malwareTop 24%
Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.3
Detection rules54th pct
Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.Portable Executable Injection MITRE reference T1055.002
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Gorgon GroupG0078 ↗
Malware can download a remote access tool, ShiftyBug, and inject into another process.1
All 2 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
3CX Supply Chain AttackC0057 ↗
During the 3CX Supply Chain Attack, AppleJeus uses the SigFlip tool to inject arbitrary code without affecting or breaking the file's signature.12
All 1 campaigns for this technique
12 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
RustyWaterS9037 ↗
Has injected its shellcode into explorer.exe by allocating memory via VirtualAllocEx, then by writing the payload via WriteProcessMemory.1
SPAWNCHIMERAS9024 ↗
Has executed only in memory and hooked itself into existing processes on the victim device to include the web process.123
HavocS1229 ↗
Has itself injected into C:\\Windows\\System32\\Werfault.exe on targeted systems.1
DUSTPANS1158 ↗
Can inject its decrypted payload into another process.1
PikabotS1145 ↗
Pikabot, following payload decryption, creates a process hard-coded into the dropped (e.g., WerFault.exe) and injects the decrypted core modules into it.1
GootloaderS1138 ↗
Can use its own PE loader to execute payloads in memory.1
All 12 software entries for this technique · 6 newest in this preview
Offense vs defense T1055.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 3
first rule: 2022 Q4 · 1 of 1 campaigns plottedPortable Executable Injection detection strategy DET0106
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of PE Injection via Remote Memory Mapping
1 platform
AN0297 · Windows
Detects PE injection through a behavioral sequence where one process opens (OpenProcess) a handle to another, allocates remote memory (VirtualAllocEx), writes a PE header (MZ) or shellcode (WriteProcessMemory), then initiates a new thread (CreateRemoteThread or NtCreateThreadEx) in that process—executing injected code in memory without touching disk. Optional: injects a trampoline or shellcode that unpacks/reflectively maps the payload.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | WinEventLog:Sysmon | EventCode=8 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PayloadEntropyThreshold | Controls for detecting high-entropy memory writes indicating shellcode or encrypted PE |
| TargetProcessList | High-value or sensitive processes that should never have remote threads injected |
| TimeWindow | Max allowed delay between memory write and thread execution |
| ParentProcessAnomalyThreshold | Used to filter legitimate process hierarchies vs anomalous injection sources |
Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.
Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition