Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1055.002: Portable Executable Injection

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.

PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. [1]

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.

EnterpriseT1055.002Sub-techniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Portable Executable Injection is a Windows process-injection behavior where malicious code is run inside another live process. For leaders, the material risk is that activity may appear to come from a legitimate process, weakening simple process-name, file-on-disk, or signature-based defenses. Because ATT&CK maps this sub-technique to stealth and privilege escalation, it is important for validating endpoint detection depth, incident response triage, and evidence that controls can see suspicious in-memory behavior rather than only known malware files.

Executive priority

Prioritize this as an endpoint resilience and incident-response readiness issue for Windows environments. Security leaders should ask whether endpoint controls can observe and block suspicious process behavior, remote memory mapping, and code execution inside trusted processes, not just alert on malicious binaries. This also has audit and risk-management value: coverage should be evidenced through endpoint telemetry, behavioral detections, and response playbooks for suspicious process injection. The relationship set shows this behavior is associated with multiple ATT&CK software entries and at least one campaign, so it is a useful control-validation target without assuming current exposure or active exploitation in any specific environment.

Technical view

For SOC, detection engineering, and IR teams, validate Windows visibility around PE injection as a sub-technique of Process Injection. The supplied ATT&CK description highlights remote process memory allocation and writing, with examples including VirtualAllocEx, WriteProcessMemory, and execution through CreateRemoteThread or related code. Official ATT&CK detection text is not provided, but the related detection strategy DET0106, Behavioral Detection of PE Injection via Remote Memory Mapping, supports behavior-based analytics focused on remote memory mapping and execution patterns. Triage should correlate the source process, target process, process integrity/privilege context, memory activity, thread creation, image/module evidence, and follow-on network or system access by the injected process.

Likely telemetry

  • Windows endpoint process creation and parent/child process lineage
  • Endpoint detection and response events for suspicious process behavior
  • Process access events involving one process opening or manipulating another process
  • Remote memory allocation, memory write, and memory protection-change telemetry where available
  • Remote thread creation or equivalent cross-process execution telemetry

Detection direction

  • Build or validate behavior-based analytics aligned to DET0106 for remote memory mapping and PE injection patterns rather than relying only on process names or file signatures.
  • Tune detections around unusual source-to-target process pairs, unexpected cross-process memory writes, and execution beginning inside a process that did not load code through normal application behavior.
  • Correlate injection-like events with privilege context because the technique is mapped to privilege escalation as well as stealth.
  • Account for false positives from legitimate security tools, debuggers, application compatibility tools, and enterprise software that may inspect or manipulate process memory.
  • Validate that telemetry survives common blind spots: missing endpoint sensor coverage, reduced API-level visibility, lack of memory-event collection, and allow-listing that trusts a process name without inspecting behavior.

Mitigation priorities

  • Prioritize M1040 Behavior Prevention on Endpoint for Windows systems: controls should analyze process, file, API, and endpoint behavior rather than depend solely on known signatures.
  • Harden endpoint policy to block or alert on suspicious cross-process memory manipulation and anomalous process execution patterns where operationally safe.
  • Ensure high-value Windows endpoints and administrative workstations have endpoint monitoring capable of capturing process-injection-relevant behavior.
  • Use controlled testing to prove prevention and detection coverage for PE injection behavior, then document results for compliance and risk evidence.
  • Integrate confirmed alerts into IR playbooks that include process containment, memory-aware triage, privilege review, and investigation of activity performed under the injected process context.
Analyst notes and limits

This take is based on ATT&CK T1055.002, its parent relationship to Process Injection, the supplied DET0106 detection-strategy relationship, M1040 mitigation relationship, and listed campaign/group/software relationships. The most important defender decision is whether endpoint controls can see behavior occurring inside a legitimate process, because process identity alone may be misleading.

ATT&CK does not provide official detection text for this object, so detection guidance is inferred conservatively from the technique description and the DET0106 relationship. The technique platform is Windows; related software may list other platforms, but that does not expand this object’s supported platform scope. Local baselines, endpoint sensor capability, and approved administrative tools are required to distinguish malicious injection from legitimate process-memory activity.

Official MITRE ATT&CK definition

Portable Executable Injection

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.

PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. [1]

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1055 Process Injection This object subtechnique of Process Injection.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0106: Rocke

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.[1]

Group Enterprise

G0078: Gorgon Group

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]

Tool Enterprise

S1063: Brute Ratel C4

Brute Ratel C4 is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. Brute Ratel C4 was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence. In September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.[1][2][3][4][5]

Windows
Malware Enterprise

S0260: InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]

Windows
Malware Enterprise

S1229: Havoc

Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.

LinuxmacOSWindows
Malware Enterprise

S0030: Carbanak

Carbanak is a full-featured, remote backdoor used by a group of the same name (Carbanak). It is intended for espionage, data exfiltration, and providing remote access to infected machines. [1] [2]

Windows
Malware Enterprise

S0681: Lizar

Lizar is a modular remote access tool written using the .NET Framework that shares structural similarities to Carbanak. It has likely been used by FIN7 since at least February 2021.[1][2][3]

Windows
Malware Enterprise

S1138: Gootloader

Gootloader is a Javascript-based infection framework that has been used since at least 2020 as a delivery method for the Gootkit banking trojan, Cobalt Strike, REvil, and others. Gootloader operates on an "Initial Access as a Service" model and has leveraged SEO Poisoning to provide access to entities in multiple sectors worldwide including financial, military, automotive, pharmaceutical, and energy.[1][2]

Windows
Malware Enterprise

S9024: SPAWNCHIMERA

SPAWNCHIMERA is a backdoor that supports command and control and can inject malicious components into native processes.[1][2][3] SPAWNCHIMERA It incorporates capabilities from multiple tools within the SPAWN malware family, including SPAWNANT, SPAWNMOLE, and SPAWNSNAIL.[4][2][3] SPAWNCHIMERA was first reported in April 2024.[2] SPAWNCHIMERA has been observed in activity attributed to People's Republic of China (PRC) state-sponsored threat actors, including UNC5221..[4][5][2][6]

LinuxNetwork Devices
Malware Enterprise

S1145: Pikabot

Pikabot is a backdoor used for initial access and follow-on tool deployment active since early 2023. Pikabot is notable for extensive use of multiple encoding, encryption, and defense evasion mechanisms to evade defenses and avoid analysis. Pikabot has some overlaps with QakBot, but insufficient evidence exists to definitively link these two malware families. Pikabot is frequently used to deploy follow on tools such as Cobalt Strike or ransomware variants.[1][2][3]

Windows
Malware Enterprise

S0330: Zeus Panda

Zeus Panda is a Trojan designed to steal banking information and other sensitive credentials for exfiltration. Zeus Panda’s original source code was leaked in 2011, allowing threat actors to use its source code as a basis for new malware variants. It is mainly used to target Windows operating systems ranging from Windows XP through Windows 10.[1][2]

Windows
Campaign Enterprise

C0057: 3CX Supply Chain Attack

The 3CX Supply Chain Attack was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies. This provided UNC4736, a threat cluster associated with AppleJeus, access to the 3CX environment. From there UNC4736 compromised the Windows and macOS build environments used to distribute the 3CX desktop application to their customers.[1] While 3CX serves more than 600,000 customers and 12 million users, only a subset of systems were affected. Subsequent targeting focused on victims in the defense and cryptocurrency sectors, where attackers deployed secondary payloads such as Gopuram for credential theft and persistence.[2] The campaign began in late 2022 and was disrupted after security vendors publicly reported the compromise in March 2023.[3][4]

Relationship explorer

All related ATT&CK context

uses · Tool S1063: Brute Ratel C4 Enterprise mitigates · Mitigation M1040: Behavior Prevention on Endpoint Enterprise uses · Malware S0260: InvisiMole Enterprise uses · Malware S1229: Havoc Enterprise uses · Malware S0030: Carbanak Enterprise uses · Malware S9037: RustyWater Enterprise uses · Group G0106: Rocke Enterprise detects · Detection Strategy DET0106: Behavioral Detection of PE Injection via Remote Memory Mapping Enterprise uses · Group G0078: Gorgon Group Enterprise uses · Malware S0681: Lizar Enterprise uses · Malware S1138: Gootloader Enterprise uses · Malware S9024: SPAWNCHIMERA Enterprise uses · Malware S0342: GreyEnergy Enterprise uses · Malware S1158: DUSTPAN Enterprise uses · Malware S1145: Pikabot Enterprise uses · Malware S0330: Zeus Panda Enterprise uses · Campaign C0057: 3CX Supply Chain Attack Enterprise subtechnique of · Technique T1055: Process Injection Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1040: Behavior Prevention on Endpoint

Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures:

Suspicious Process Behavior:

- Implementation: Use Endpoint Detection and Response (EDR) tools to monitor and block processes exhibiting unusual behavior, such as privilege escalation attempts. - Use Case: An attacker uses a known vulnerability to spawn a privileged process from a user-level application. The endpoint tool detects the abnormal parent-child process relationship and blocks the action.

Unauthorized File Access:

- Implementation: Leverage Data Loss Prevention (DLP) or endpoint tools to block processes attempting to access sensitive files without proper authorization. - Use Case: A process tries to read or modify a sensitive file located in a restricted directory, such as /etc/shadow on Linux or the SAM registry hive on Windows. The endpoint tool identifies this anomalous behavior and prevents it.

Abnormal API Calls:

- Implementation: Implement runtime analysis tools to monitor API calls and block those associated with malicious activities. - Use Case: A process dynamically injects itself into another process to hijack its execution. The endpoint detects the abnormal use of APIs like `OpenProcess` and `WriteProcessMemory` and terminates the offending process.

Exploit Prevention:

- Implementation: Use behavioral exploit prevention tools to detect and block exploits attempting to gain unauthorized access. - Use Case: A buffer overflow exploit is launched against a vulnerable application. The endpoint detects the anomalous memory write operation and halts the process.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
f401c09271ff94a2...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle f401c09271ff…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Elastic Process Injection July 2017

    Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.

    Open source URL
  2. [2]
    mitre-attack T1055.002
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use