tfMITRE ATT&CK sub-technique

Thread Execution Hijacking T1055.003

sub-technique of T1055 Process Injection

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 2.0
Created: 14 January 2020
Last modified: 12 May 2026

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Thread Execution Hijacking MITRE reference T1055.003

62nd pctamong all ATT&CK techniques for number of tools

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PikabotS1145 ↗

Can create a suspended instance of a legitimate process (e.g., ctfmon.exe), allocate memory within the suspended process corresponding to Pikabot's core module, then redirect execution flow via SetContextThread API so that when the thread resumes the Pikabot core module is executed.1

created 2024-07-12MALWAREcarried by 1 group

WaterbearS0579 ↗

Can use thread injection to inject shellcode into the process of security software.1

created 2021-02-22MALWAREcarried by 1 group

GazerS0168 ↗

Performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.1 2

created 2018-01-16MALWAREcarried by 1 group

Trojan.KaraganyS0094 ↗

Can inject a suspended thread of its own process into a new process and initiate via the ResumeThread API.1

created 2017-05-31MALWAREcarried by 1 group

All 4 software entries for this technique

Offense vs defense T1055.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 1

first rule: 2021 Q3

Thread Execution Hijacking detection strategy DET0295

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Thread Execution Hijacking via Thread Suspension and Context Switching

Enterprise

1 platform

AN0822 · Windows

Detects hijacking of an existing thread (OpenThread) through a behavioral chain involving thread suspension (SuspendThread), memory modification (VirtualAllocEx + WriteProcessMemory), context manipulation (SetThreadContext), and thread resumption—all within another live process's address space (ResumeThread).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	WinEventLog:Sysmon	EventCode=8
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	API Calls
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetProcessList	Sensitive processes that should never be targeted for thread hijack attempts
TimeWindow	Expected delay between SuspendThread and ResumeThread events; tight thresholds reduce evasion
SuspiciousThreadContextRegions	Memory regions or offsets that should not be targeted for SetThreadContext
ParentProcessAnomalyThreshold	Score deviation of the parent/child relationship in a thread injection chain

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Thread Execution Hijacking	windows	PowerShell	—	—	—
This test injects a MessageBox shellcode generated by msfvenom in Notepad.exe using Thread Execution Hijacking. When successful, a message box will appear with the "Atomic Red Team" caption after one or two seconds. Attack command $notepad = Start-Process notepad -passthru Start-Process "$PathToAtomicsFolder\T1055.003\bin\InjectContext.exe" Start-Sleep -Seconds 5 Stop-Process $notepad.id GUIDc58aad25-ed0d-4b19-a69c-cc158e286121

Tests from Atomic Red Team (MIT licence) · technique definition

Thread Execution Hijacking detections T1055.003

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs