Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process telemetry. Use when hunting for in-memory code injection or defense evasion via legitimate process abuse on Windows endpoints.
Start a fresh conversation. Replace the highlighted placeholders.
Use hunting-for-process-injection-techniques to analyze [JSON Sysmon logs containing Event IDs 1, 8, and 10] and produce a ranked process-injection hunt report with MITRE mappings.
Required inputs
[JSON Sysmon logs containing Event IDs 1, 8, and 10]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: hunting-for-process-injection-techniquesdescription: Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process telemetry. Use when hunting for in-memory code injection or defense evasion via legitimate process abuse on Windows endpoints.domain: cybersecuritysubdomain: threat-huntingtags: - process-injection- t1055- sysmon- createremotethread- dll-injection- edr- threat-huntingversion: '1.0'author: mahipallicense: Apache-2.0d3fend_techniques: - Executable Denylisting- Execution Isolation- File Metadata Consistency Validation- Content Format Conversion- File Content Analysisnist_csf: - DE.CM-01- DE.AE-02- DE.AE-07- ID.RA-05mitre_attack: - T1046- T1057- T1082- T1083- T1055
Hunting for Process Injection Techniques
Overview
Process injection (MITRE ATT&CK T1055) allows adversaries to execute code in the address space of another process, enabling defense evasion and privilege escalation. This skill detects injection techniques via Sysmon Event ID 8 (CreateRemoteThread), Event ID 10 (ProcessAccess with suspicious access rights), and analysis of source-target process relationships to distinguish legitimate from malicious injection.
When to Use
When investigating security incidents that require hunting for process injection techniques
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Sysmon installed with Event IDs 8 and 10 enabled
Process creation logs (Sysmon Event ID 1 or Windows 4688)
Python 3.8+ with standard library
JSON-formatted Sysmon event logs
Steps
Parse Sysmon Events — Ingest Event IDs 1, 8, and 10 from JSON log files
Detect CreateRemoteThread — Flag Event ID 8 with suspicious source-target process pairs
Analyze ProcessAccess Rights — Identify Event ID 10 with dangerous access masks (PROCESS_VM_WRITE, PROCESS_CREATE_THREAD)
Build Process Relationship Graph — Map source-to-target injection relationships
Filter Known Legitimate Pairs — Exclude known benign injection patterns (AV, debuggers, system processes)
Score Injection Severity — Apply risk scoring based on source process, target process, and access rights
Generate Hunt Report — Produce structured report with MITRE sub-technique mapping
Expected Output
JSON report of detected injection events with severity scores