Process injection is a technique in which malicious code is run inside the address space of another, usually legitimate, process in order to hide its activity and inherit that process’s privileges.
How process injection works
On Windows, the classic sequence is simple: the attacker opens a handle to a target process, allocates memory in it (VirtualAllocEx), writes code there (WriteProcessMemory) and starts it with CreateRemoteThread. MITRE ATT&CK catalogues the technique as T1055 and lists many variants:
- DLL injection (T1055.001) – forcing a process to load a malicious library.
- Thread execution hijacking (T1055.003) – suspending an existing thread and redirecting it to injected code.
- APC injection (T1055.004) – queuing code to run when a thread enters an alertable state.
- Process hollowing (T1055.012) – starting a legitimate program in a suspended state, replacing its memory with a malicious image and resuming it.
Similar techniques exist on Linux (for example via ptrace or LD_PRELOAD) and macOS.
Why process injection matters
Code running inside explorer.exe, svchost.exe or a browser looks like normal system activity, can use that process’s network access and may survive file-based scanning, because the payload often never touches the disk. Injection is therefore a core building block of fileless malware, banking trojans that hook browser functions, and post-exploitation frameworks such as Cobalt Strike, whose beacons routinely migrate into other processes. It is closely related to DLL hijacking, which also abuses the way Windows loads code.
How to detect and prevent process injection
- Deploy EDR that monitors cross-process memory writes, remote thread creation and unusual memory regions marked executable.
- Enable protections such as Protected Process Light for LSASS and Attack Surface Reduction rules.
- Limit administrative rights, since injecting into privileged processes usually requires them.
- Investigate system processes that make unexpected network connections.
