T1055.002 Portable Executable Injection Mappings

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.

PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>, then invoked with <code>CreateRemoteThread</code> or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Elastic Process Injection July 2017)

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-6 Least Privilege Protects T1055.002 Portable Executable Injection
SC-18 Mobile Code Protects T1055.002 Portable Executable Injection
SC-7 Boundary Protection Protects T1055.002 Portable Executable Injection
SI-2 Flaw Remediation Protects T1055.002 Portable Executable Injection
SI-3 Malicious Code Protection Protects T1055.002 Portable Executable Injection
SI-4 System Monitoring Protects T1055.002 Portable Executable Injection
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.002 Process Injection: Portable Executable Injection