93 lines
2.9 KiB
Markdown
93 lines
2.9 KiB
Markdown
---
|
|
name: detecting-process-injection-in-memory
|
|
description: 'Detects process injection in a memory image by identifying private executable regions
|
|
with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style
|
|
analysis. Activates for requests to detect process injection, find injected code in memory, or
|
|
triage suspicious executable regions in a memory image.'
|
|
domain: cybersecurity
|
|
subdomain: malware-analysis
|
|
tags:
|
|
- malware-analysis
|
|
- memory-forensics
|
|
- process-injection
|
|
- volatility
|
|
- malfind
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1055
|
|
- T1055.001
|
|
- T1055.012
|
|
d3fend:
|
|
- D3-PSA
|
|
- D3-SDA
|
|
car:
|
|
- CAR-2014-04-003
|
|
references:
|
|
- 'MITRE ATT&CK T1055 Process Injection — https://attack.mitre.org/techniques/T1055/'
|
|
- 'Volatility 3 windows.malfind — https://volatility3.readthedocs.io/'
|
|
---
|
|
|
|
# Detecting Process Injection in Memory
|
|
|
|
## When to Use
|
|
|
|
- You have a Windows memory image and want to find injected/hollowed code.
|
|
- You are triaging private RWX regions, unbacked executable memory, and PE headers in private
|
|
allocations (classic injection/hollowing signs).
|
|
|
|
**Do not use** this on a live production host without authorization — work from an acquired image.
|
|
This skill interprets analysis output; run Volatility separately on the image.
|
|
|
|
## Prerequisites
|
|
|
|
- A memory image and Volatility 3 (`windows.malfind`, `windows.vadinfo`) installed.
|
|
|
|
## Safety & Handling
|
|
|
|
- Treat carved injected regions as live malicious code; store them password-protected.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Run malfind and capture output
|
|
|
|
```bash
|
|
vol -f memory.raw windows.malfind > malfind.txt
|
|
```
|
|
|
|
### Step 2: Score injection candidates
|
|
|
|
```bash
|
|
python scripts/analyst.py score malfind.txt
|
|
```
|
|
|
|
Flags regions with `PAGE_EXECUTE_READWRITE`, MZ/PE headers in private memory, and shellcode-like
|
|
disassembly hints, ranking processes by suspicion.
|
|
|
|
### Step 3: Corroborate
|
|
|
|
Cross-check flagged PIDs with `windows.vadinfo` (private, executable, no mapped file) and the
|
|
process tree for anomalous parents.
|
|
|
|
### Step 4: Carve and route
|
|
|
|
Carve the injected region for follow-on shellcode/PE recovery and analysis.
|
|
|
|
## Validation
|
|
|
|
- Flagged regions are private + executable, not legitimate mapped images.
|
|
- PE-in-private-memory findings are confirmed by an MZ/`This program` signature.
|
|
- High-scoring PIDs corroborate with VAD protections and process-tree anomalies.
|
|
|
|
## Pitfalls
|
|
|
|
- JIT engines (.NET, Java, browsers) legitimately create RWX regions — corroborate before alerting.
|
|
- Relying on malfind alone; pair with vadinfo and ldrmodules.
|
|
- Missing hollowing where the region is RX (not RWX) after protection change.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the scorer.
|
|
- ATT&CK T1055 and Volatility 3 docs (linked in frontmatter).
|