CANONSTAGERS1237 ↗
Uses the Thread Local Storage (TLS) array data structure to store function addresses resolved by its custom API hashing algorithm. The function addresses are later called throughout the binary from offsets into the TLS array.1
- Tactics
- Privilege Escalation, Stealth
- Platform
- Windows
- Version
- 2.0
- Created
- 14 January 2020
- Last modified
- 12 May 2026
Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Thread Local Storage MITRE reference T1055.005
51st pctamong all ATT&CK techniques for number of tools
Offense vs defense T1055.005
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Thread Local Storage detection strategy DET0467
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for TLS Callback Injection via PE Memory Modification and Hollowing
1 platform
AN1289 · Windows
Detects thread local storage (TLS) callback injection by monitoring memory modifications to PE headers and TLS directory structures during or after process hollowing events, followed by anomalous thread behavior prior to main entry point execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process ModificationDC0020 | WinEventLog:Sysmon | EventCode=8 |
| OS API ExecutionDC0021 | EDR:memory | MemoryWriteToExecutable |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetProcessFilter | Subset of processes whose TLS callbacks should not change post-load (e.g., explorer.exe, lsass.exe) |
| TimeWindowBetweenLoadAndTLSModification | Acceptable delay between image load and memory tampering in .tls or .data sections |
| AnomalousThreadStartThreshold | Number of threads executing prior to main entry point that is considered suspicious |
| PayloadEntropyThreshold | Optional threshold to distinguish injected shellcode from benign memory writes |
Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.