tfMITRE ATT&CK sub-technique

Process Doppelgänging T1055.013

sub-technique of T1055 Process Injection

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 2.0
Created: 14 January 2020
Last modified: 12 May 2026

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Process Doppelgänging MITRE reference T1055.013

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

LeafminerG0077 ↗

Has used Process Doppelgänging to evade security software while deploying tools on compromised systems.1

created 2018-10-171 referenceaka Raspite

All 1 groups for this technique

Offense vs defense T1055.013

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2026 Q2

Process Doppelgänging detection strategy DET0544

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Process Doppelgänging on Windows

Enterprise

1 platform

AN1501 · Windows

Detects adversary abuse of Transactional NTFS (TxF) and undocumented process loading mechanisms (e.g., NtCreateProcessEx) to create a hollowed process from an uncommitted, maliciously tainted file image in memory, later executed via NtCreateThreadEx.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	CreateTransaction, CreateFileTransacted, RollbackTransaction, NtCreateProcessEx, NtCreateThreadEx
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TransactionExecutableNamePattern	Pattern of legitimate executables often used as doppelgänging targets (e.g., svchost.exe, calc.exe)
TimeWindow_TransactionToExecution	Time delta between TxF rollback and thread creation in hollowed process
ThreadStartEntropyThreshold	Entropy level of thread start address in memory used to detect obfuscated shellcode
TxF API Call Frequency Threshold	Limit on CreateTransaction + RollbackTransaction sequences per process

Process Doppelgänging detections T1055.013

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs