InvisiMoleS0260 ↗
Has used ListPlanting to inject code into a trusted process.1
- Tactics
- Privilege Escalation, Stealth
- Platform
- Windows
- Version
- 2.0
- Created
- 22 November 2021
- Last modified
- 12 May 2026
- Contributor
- ESET
Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.[1] Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.ListPlanting MITRE reference T1055.015
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1055.015
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
ListPlanting detection strategy DET0331
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for ListPlanting Injection on Windows
1 platform
AN0941 · Windows
Detects the use of message-based injection by monitoring for sequences involving FindWindow (EnumWindows or EnumChildWindows), VirtualAllocEx or related API calls, combined with suspicious PostMessage/SendMessage (e.g., LVM_SETITEMPOSITION) use to SysListView32 controls, followed by LVM_SORTITEMS invocation instead of WriteProcessMemory.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | WinEventLog:Sysmon | EventCode=8 |
| OS API ExecutionDC0021 | etw:Microsoft-Windows-Win32k | SendMessage, PostMessage, LVM_* |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow_PostMessage_to_LVM_SORTITEMS | Defines temporal distance between payload copy and execution trigger |
| TargetWindowClassName | Restrict detection to SysListView32 or similar GUI elements |
| UserContextAnomalyThreshold | Adjusts detection sensitivity to users sending window messages across session boundaries |
| InterprocessWindowMessagingFrequency | Raise alert when rate of message-passing to foreign GUI processes exceeds baseline |
Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.
Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition