MITRE ATT&CK - Техника Внедрение DLL-библиотек

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Process Injection: Внедрение DLL-библиотек

Other sub-techniques of Process Injection (12)

ID	Название
.001	Внедрение DLL-библиотек
.002	Внедрение PE-образа
.003	Перехват выполнения потока
.004	Асинхронный вызов процедур
.005	Локальная память потока
.008	Системные вызовы ptrace
.009	Внедрение через файловую систему /proc
.011	Внедрение в дополнительную память окна (EWM)
.012	Внедрение в пустой процесс
.013	Process Doppelgänging
.014	Перехват виртуального динамического общего объекта (VDSO)
.015	Внедрение списков

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process. DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). (Citation: Elastic Process Injection July 2017) Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017) Another variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process.(Citation: Module Stomping for Shellcode Injection) This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.(Citation: Hiding Malicious Code with Module Stomping) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process.

ID: T1055.001

Относится к технике: T1055

Тактика(-и): Defense Evasion, Privilege Escalation

Платформы: Windows

Требуемые разрешения: User

Источники данных: Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification

Версия: 1.2

Дата создания: 14 Jan 2020

Последнее изменение: 18 Oct 2022

Название	Описание
Примеры процедур
Heyoka Backdoor	Heyoka Backdoor can inject a DLL into rundll32.exe for execution.(Citation: SentinelOne Aoqin Dragon June 2022)
Saint Bot	Saint Bot has injected its DLL component into `EhStorAurhn.exe`.(Citation: Malwarebytes Saint Bot April 2021)
Emissary	Emissary injects its DLL file into a newly spawned Internet Explorer process.(Citation: Lotus Blossom Dec 2015)
Remsec	Remsec can perform DLL injection.(Citation: Kaspersky ProjectSauron Technical Analysis)
BlackEnergy	BlackEnergy injects its DLL component into svchost.exe.(Citation: F-Secure BlackEnergy 2014)
Turla	Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.(Citation: ESET Turla Mosquito May 2018)(Citation: Github Rapid7 Meterpreter Elevate)
PS1	PS1 can inject its payload DLL Into memory.(Citation: BlackBerry CostaRicto November 2020)
Koadic	Koadic can perform process injection by using a reflective DLL.(Citation: Github Koadic)
RARSTONE	After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.(Citation: Camba RARSTONE)
Cobalt Strike	Cobalt Strike has the ability to load DLLs via reflective injection.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
SDBbot	SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.(Citation: Proofpoint TA505 October 2019)
Metamorfo	Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).(Citation: Medium Metamorfo Apr 2020)
ComRAT	ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020)
Socksbot	Socksbot creates a suspended svchost process and injects its DLL into it.(Citation: TrendMicro Patchwork Dec 2017)
Bumblebee	The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)
Lizar	Lizar has used the PowerKatz plugin that can be loaded into the address space of a PowerShell process through reflective DLL loading.(Citation: BiZone Lizar May 2021)
FunnyDream	The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.(Citation: Bitdefender FunnyDream Campaign November 2020)
Maze	Maze has injected the malware DLL into a target process.(Citation: McAfee Maze March 2020)(Citation: Sophos Maze VM September 2020)
Matryoshka	Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.(Citation: CopyKittens Nov 2015)
Pupy	Pupy can migrate into another process using reflective DLL injection.(Citation: GitHub Pupy)
PowerSploit	PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
FinFisher	FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
PipeMon	PipeMon can inject its modules into various processes using reflective DLL loading.(Citation: ESET PipeMon May 2020)
Dyre	Dyre injects into other processes to load modules.(Citation: Symantec Dyre June 2015)
BackdoorDiplomacy	BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.(Citation: ESET BackdoorDiplomacy Jun 2021)
Get2	Get2 has the ability to inject DLLs into processes.(Citation: Proofpoint TA505 October 2019)
Taidoor	Taidoor can perform DLL loading.(Citation: TrendMicro Taidoor)(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
RATANKBA	RATANKBA performs a reflective DLL injection using a given pid.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)
MegaCortex	MegaCortex loads `injecthelper.dll` into a newly created `rundll32.exe` process.(Citation: IBM MegaCortex)
Stuxnet	Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.(Citation: Symantec W.32 Stuxnet Dossier)
	During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.(Citation: DFIR Conti Bazar Nov 2021)
Leviathan	Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.(Citation: Accenture MUDCARP March 2019)
Kazuar	If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.(Citation: Unit 42 Kazuar May 2017)
Duqu	Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).(Citation: Symantec W32.Duqu)
PoisonIvy	PoisonIvy can inject a malicious DLL into a process.(Citation: FireEye Poison Ivy)(Citation: Symantec Darkmoon Aug 2005)
Derusbi	Derusbi injects itself into the secure shell (SSH) process.(Citation: Airbus Derusbi 2015)
ZxShell	ZxShell is injected into a shared SVCHOST process.(Citation: Talos ZxShell Oct 2014)
Putter Panda	An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).(Citation: CrowdStrike Putter Panda)
Gelsemium	Gelsemium has the ability to inject DLLs into specific processes.(Citation: ESET Gelsemium June 2021)
HIDEDRV	HIDEDRV injects a DLL for Downdelph into the explorer.exe process.(Citation: ESET Sednit Part 3)
Carbon	Carbon has a command to inject code into a process.(Citation: ESET Carbon Mar 2017)
Lazarus Group	A Lazarus Group malware sample performs reflective DLL injection.(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: Lazarus APT January 2022)
Tropic Trooper	Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)
IronNetInjector	IronNetInjector has the ability to inject a DLL into running processes, including the IronNetInjector DLL into explorer.exe.(Citation: Unit 42 IronNetInjector February 2021 )
TajMahal	TajMahal has the ability to inject DLLs for malicious plugins into running processes.(Citation: Kaspersky TajMahal April 2019)
Mongall	Mongall can inject a DLL into `rundll32.exe` for execution.(Citation: SentinelOne Aoqin Dragon June 2022)
Conti	Conti has loaded an encrypted DLL into memory and then executes it.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020)
Ramsay	Ramsay can use `ImprovedReflectiveDLLInjection` to deploy components.(Citation: Eset Ramsay May 2020)
Carberp	Carberp's bootkit can inject a malicious DLL into the address space of running processes.(Citation: ESET Carberp March 2012)
SombRAT	SombRAT can execute `loadfromfile`, `loadfromstorage`, and `loadfrommem` to inject a DLL from disk, storage, or memory respectively.(Citation: BlackBerry CostaRicto November 2020)
Sykipot	Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.(Citation: AlienVault Sykipot 2011)
Emotet	Emotet has been observed injecting in to Explorer.exe and other processes. (Citation: Picus Emotet Dec 2018)(Citation: Trend Micro Banking Malware Jan 2019)(Citation: US-CERT Emotet Jul 2018)
Aria-body	Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.(Citation: CheckPoint Naikon May 2020)
Netwalker	The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.(Citation: TrendMicro Netwalker May 2020)
TA505	TA505 has been seen injecting a DLL into winword.exe.(Citation: IBM TA505 April 2020)
Elise	Elise injects DLL files into iexplore.exe.(Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)
Wizard Spider	Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)
ShadowPad	ShadowPad has injected a DLL into svchost.exe.(Citation: Kaspersky ShadowPad Aug 2017)

Контрмера	Описание
Контрмеры
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.

Обнаружение

Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as CreateRemoteThread and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.(Citation: Elastic Process Injection July 2017) Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.