MITRE ATT&CK - Техника Внедрение кода в процессы

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Внедрение кода в процессы

Sub-techniques (12)

ID	Name
.001	Внедрение DLL-библиотек
.002	Внедрение PE-образа
.003	Перехват выполнения потока
.004	Асинхронный вызов процедур
.005	Локальная память потока
.008	Системные вызовы ptrace
.009	Внедрение через файловую систему /proc
.011	Внедрение в дополнительную память окна (EWM)
.012	Внедрение в пустой процесс
.013	Process Doppelgänging
.014	Перехват виртуального динамического общего объекта (VDSO)
.015	Внедрение списков

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. There are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

ID: T1055

Суб-техники: .001 .002 .003 .004 .005 .008 .009 .011 .012 .013 .014 .015

Тактика(-и): Defense Evasion, Privilege Escalation

Платформы: Linux, macOS, Windows

Источники данных: File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification

Версия: 1.3

Дата создания: 31 May 2017

Последнее изменение: 18 Oct 2022

Название	Описание
Примеры процедур
Agent Tesla	Agent Tesla can inject into known, vulnerable binaries on targeted hosts.(Citation: SentinelLabs Agent Tesla Aug 2020)
Lizar	Lizar can migrate the loader into another process.(Citation: BiZone Lizar May 2021)
SLOTHFULMEDIA	SLOTHFULMEDIA can inject into running processes on a compromised host.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
IronNetInjector	IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.(Citation: Unit 42 IronNetInjector February 2021 )
HyperBro	HyperBro can run shellcode it injects into a newly created process.(Citation: Unit42 Emissary Panda May 2019)
Sliver	Sliver can inject code into local and remote processes.(Citation: Bishop Fox Sliver Framework August 2019)(Citation: GitHub Sliver C2)
Bazar	Bazar can inject code through calling `VirtualAllocExNuma`.(Citation: Cybereason Bazar July 2020)
Silence	Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.(Citation: Group IB Silence Sept 2018)
TSCookie	TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.(Citation: JPCert BlackTech Malware September 2019)
REvil	REvil can inject itself into running processes on a compromised host.(Citation: McAfee REvil October 2019)
Donut	Donut includes a subproject `DonutTest` to inject shellcode into a target process.(Citation: Donut Github)
BBK	BBK has the ability to inject shellcode into svchost.exe.(Citation: Trend Micro Tick November 2019)
GuLoader	GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.(Citation: Medium Eli Salem GuLoader April 2021)
Honeybee	Honeybee uses a batch file to load a DLL into the svchost.exe process.(Citation: McAfee Honeybee)
APT32	APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.(Citation: Cybereason Cobalt Kitty 2017)
AuditCred	AuditCred can inject code from files to other running processes.(Citation: TrendMicro Lazarus Nov 2018)
gh0st RAT	gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.(Citation: Gh0stRAT ATT March 2019)
NETWIRE	NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.(Citation: Red Canary NETWIRE January 2020)
Backdoor.Oldrea	Backdoor.Oldrea injects itself into explorer.exe.(Citation: Symantec Dragonfly)(Citation: Gigamon Berserk Bear October 2021)
Remcos	Remcos has a command to hide itself through injecting into another process.(Citation: Fortinet Remcos Feb 2017)
Waterbear	Waterbear can inject decrypted shellcode into the LanmanServer service.(Citation: Trend Micro Waterbear December 2019)
SILENTTRINITY	SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.(Citation: GitHub SILENTTRINITY Modules July 2019)
Cobalt Strike	Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.(Citation: cobaltstrike manual)(Citation: Cobalt Strike Manual 4.3 November 2020)(Citation: DFIR Conti Bazar Nov 2021)
HTRAN	HTRAN can inject into into running processes.(Citation: NCSC Joint Report Public Tools)
Clambling	Clambling can inject into the `svchost.exe` process for execution.(Citation: Trend Micro DRBControl February 2020)
Wiarp	Wiarp creates a backdoor through which remote attackers can inject files into running processes.(Citation: Symantec Wiarp May 2012)
Cobalt Group	Cobalt Group has injected code into trusted processes.(Citation: Group IB Cobalt Aug 2017)
JPIN	JPIN can inject content into lsass.exe to load a module.(Citation: Microsoft PLATINUM April 2016)
StoneDrill	StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser.(Citation: Kaspersky StoneDrill 2017)
NavRAT	NavRAT copies itself into a running Internet Explorer process to evade detection.(Citation: Talos NavRAT May 2018)
QakBot	QakBot can inject itself into processes including explore.exe, Iexplore.exe, and Mobsync.exe.(Citation: Trend Micro Qakbot May 2020)(Citation: Kroll Qakbot June 2020)(Citation: Trend Micro Qakbot December 2020)(Citation: Kaspersky QakBot September 2021)
Bumblebee	Bumblebee can inject code into multiple processes on infected endpoints.(Citation: Cybereason Bumblebee August 2022)
Empire	Empire contains multiple modules for injecting into processes, such as `Invoke-PSInject`.(Citation: Github PowerShell Empire)
APT37	APT37 injects its malware variant, ROKRAT, into the cmd.exe process.(Citation: Talos Group123)
Gazer	Gazer injects its communication module into an Internet accessible process through which it performs C2.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017)
InvisiMole	InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.(Citation: ESET InvisiMole June 2020)
	During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.(Citation: FoxIT Wocao December 2019)
Smoke Loader	Smoke Loader injects into the Internet Explorer process.(Citation: Talos Smoke Loader July 2018)
PoshC2	PoshC2 contains multiple modules for injecting into processes, such as `Invoke-PSInject`.(Citation: GitHub PoshC2)
ABK	ABK has the ability to inject shellcode into svchost.exe.(Citation: Trend Micro Tick November 2019)
Avenger	Avenger has the ability to inject shellcode into svchost.exe.(Citation: Trend Micro Tick November 2019)
Operation Wocao	Operation Wocao has injected code into a selected process, which in turn launches a command as a child process of the original.(Citation: FoxIT Wocao December 2019)
	During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word.(Citation: Threatpost New Op Sharpshooter Data March 2019)
CostaBricks	CostaBricks can inject a payload into the memory of a compromised host.(Citation: BlackBerry CostaRicto November 2020)
Cardinal RAT	Cardinal RAT injects into a newly spawned process created from a native Windows executable.(Citation: PaloAlto CardinalRat Apr 2017)
Attor	Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.(Citation: ESET Attor Oct 2019)
Cobalt Strike	Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.(Citation: cobaltstrike manual)
Sharpshooter	Sharpshooter has leveraged embedded shellcode to inject a downloader into the memory of Word.(Citation: McAfee Sharpshooter December 2018)
Ryuk	Ryuk has injected itself into remote processes to encrypt files using a combination of `VirtualAlloc`, `WriteProcessMemory`, and `CreateRemoteThread`.(Citation: CrowdStrike Ryuk January 2019)
WarzoneRAT	WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.(Citation: Check Point Warzone Feb 2020)
Kimsuky	Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.(Citation: Securelist Kimsuky Sept 2013)
PLATINUM	PLATINUM has used various methods of process injection including hot patching.(Citation: Microsoft PLATINUM April 2016)
ShadowPad	ShadowPad has injected an install module into a newly created process.(Citation: Kaspersky ShadowPad Aug 2017)
ROKRAT	ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.(Citation: Malwarebytes RokRAT VBA January 2021)
HOPLIGHT	HOPLIGHT has injected into running processes.(Citation: US-CERT HOPLIGHT Apr 2019)
Mis-Type	Mis-Type has been injected directly into a running process, including `explorer.exe`.(Citation: Cylance Dust Storm)
Dyre	Dyre has the ability to directly inject its code into the web browser process.(Citation: Malwarebytes Dyreza November 2015)
JHUHUGIT	JHUHUGIT performs code injection injecting its own functions to browser processes.(Citation: F-Secure Sofacy 2015)(Citation: Unit 42 Sofacy Feb 2018)
Pandora	Pandora can start and inject code into a new `svchost` process.(Citation: Trend Micro Iron Tiger April 2021)
TrickBot	TrickBot has used `Nt*` Native API functions to inject code into legitimate processes such as `wermgr.exe`.(Citation: Joe Sec Trickbot)
PcShare	The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.(Citation: Bitdefender FunnyDream Campaign November 2020)
APT41	APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.(Citation: FireEye APT41 Aug 2019)
Wingbird	Wingbird performs multiple process injections to hijack system processes and execute malicious code.(Citation: Microsoft SIR Vol 21)
Egregor	Egregor can inject its payload into iexplore.exe process.(Citation: Cyble Egregor Oct 2020)
Turla	Turla has also used PowerSploit's `Invoke-ReflectivePEInjection.ps1` to reflectively load a PowerShell payload into a random process on the victim system.(Citation: ESET Turla PowerShell May 2019)

Контрмера	Описание
Контрмеры
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.

Обнаружение

Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as CreateRemoteThread, SuspendThread/SetThreadContext/ResumeThread, QueueUserAPC/NtQueueApcThread, and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.(Citation: Elastic Process Injection July 2017) Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. Monitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics) (Citation: GNU Acct) (Citation: RHEL auditd) (Citation: Chokepoint preload rootkits) Monitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules.(Citation: Microsoft Sysmon v6 May 2017) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.