tfMITRE ATT&CK sub-technique

Asynchronous Procedure Call T1055.004

sub-technique of T1055 Process Injection

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 2.0
Created: 14 January 2020
Last modified: 12 May 2026

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Asynchronous Procedure Call MITRE reference T1055.004

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

FIN8G0061 ↗

Has injected malicious code into a new svchost.exe process.1

created 2018-04-181 referenceaka Syssphinx

All 1 groups for this technique

12 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

HeartCryptS9018 ↗

Has the ability to use NtQueueApcThread as an alternate method for process injection.1

created 2026-04-16MALWAREcarried by 1 group

XLoaderS1207 ↗

Injects code into the APC queue using NtQueueApcThread API.1

created 2025-03-11MALWARE

SardonicS1085 ↗

Can use the QueueUserAPC API to execute shellcode on a compromised machine.1

created 2023-09-05MALWAREcarried by 1 group

BADHATCHS1081 ↗

Can inject itself into a new svchost.exe -k netsvcs process using the asynchronous procedure call (APC) queue.1 2

created 2023-08-01MALWAREcarried by 1 group

BumblebeeS1039 ↗

Can use asynchronous procedure call (APC) injection to execute commands received from C2.1

created 2022-08-19MALWAREcarried by 2 groups

Saint BotS1018 ↗

Has written its payload into a newly-created EhStorAuthn.exe process using ZwWriteVirtualMemory and executed it using NtQueueApcThread and ZwAlertResumeThread.1

created 2022-06-09MALWAREcarried by 2 groups

All 12 software entries for this technique · 6 newest in this preview

Offense vs defense T1055.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2026 Q2

Asynchronous Procedure Call detection strategy DET0100

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Asynchronous Procedure Call (APC) Injection via Remote Thread Queuing

Enterprise

1 platform

AN0277 · Windows

Detects malicious injection behavior involving memory allocation, remote thread queuing via APC (e.g., QueueUserAPC), and altered thread context within another live process to execute unauthorized code under legitimate context.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	WinEventLog:Sysmon	EventCode=8
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	APCQueueOperations
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
APCTargetProcessList	Processes that are rarely or never valid targets for legitimate APC queuing (e.g., lsass.exe, winlogon.exe)
ThreadQueueDepthThreshold	The number of APCs queued within a short time window that could signal abuse
TimeWindow	Expected latency between memory allocation and thread execution through APC
UserContextSensitivity	Used to filter based on expected vs unexpected user to target process pairings

Tests3ExecutorsPowerShell 2 · cmd 1Need elevation0 of 3Have prerequisites1Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Process Injection via C#

windows

cmd

—

Process Injection using C# reference: https://github.com/pwndizzle/c-sharp-memory-injection Excercises Five Techniques 1. Process injection 2. ApcInjectionAnyProcess 3. ApcInjectionNewProcess 4. IatInjection 5. ThreadHijack Upon successful execution, cmd.exe will execute T1055.exe, which exercises 5 techniques. Output will be via stdout.

Input arguments

Name	Type	Default	Description
exe_binary	path	PathToAtomicsFolder\T1055.004\bin\T1055.exe	Output Binary

Attack command

"#{exe_binary}"

Prerequisite

#{exe_binary} must be exist on system.

Check

if (Test-Path "#{exe_binary}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{exe_binary}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1055.004/bin/T1055.exe" -OutFile "#{exe_binary}"

GUID48084ab8-6255-4e47-9a5b-d7021c318101

EarlyBird APC Queue Injection in Go

windows

PowerShell

—

Yes

Creates a process in a suspended state and calls QueueUserAPC WinAPI to add a UserAPC to the child process that points to allocated shellcode. ResumeThread is called which then calls NtTestAlert to execute the created UserAPC which then executes the shellcode. This technique allows for the early execution of shellcode and potentially before AV/EDR can hook functions to support detection. - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe) - References: - https://www.bleepingcomputer.com/news/security/early-bird-code-injection-technique-helps-malware-stay-undetected/ - https://www.ired.team/offensive-security/code-injection-process-injection/early-bird-apc-queue-code-injection

Input arguments

Name	Type	Default	Description
spawn_process_name	string	werfault	Name of the process to spawn
spawn_process_path	string	C:\Windows\System32\werfault.exe	Path of the binary to spawn

Attack command

$PathToAtomicsFolder\T1055.004\bin\x64\EarlyBird.exe -program "#{spawn_process_path}" -debug

Cleanup command

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "#{spawn_process_name}" -ErrorAction SilentlyContinue

GUID57fdf9b3-6842-4632-a700-ebcfa6f9a6be

Remote Process Injection with Go using NtQueueApcThreadEx WinAPI

windows

PowerShell

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Asynchronous Procedure Call detections T1055.004

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs