Primitive Process Injection: A Defender's Baseline
The simplest process-injection model combines cross-process access, target memory modification, and a transfer of execution. It remains valuable because more elaborate variants usually replace one stage rather than abolish the underlying need to influence another process.
This baseline is intentionally conceptual. It includes neither a callable sequence nor source code, payloads, target selection, or evasion advice.
The minimal evidence chain
A source process first needs authority over a target object. It then causes code or execution-relevant data to exist in the target, and finally influences a thread or callback to reach it. The exact APIs are less important than the security-relevant state changes: handle rights, memory ownership, page protection, writer identity, instruction pointer, and call stack.
What good telemetry records
- Source and target process identities, signers, hashes, users, sessions, integrity levels, and ancestry.
- Object access rights and whether that source-target pairing is normal.
- Allocation type, backing file, protection transitions, writer, and resulting bytes.
- Thread creation or control-flow changes, start address, instruction pointer, and stack.
- Subsequent image loads, child processes, credential access, persistence, and networking.
Detection logic and false positives
Score a sequence rather than firing on a single remote handle or writable/executable page. Development tools, debuggers, profilers, accessibility software, anti-cheat components, and endpoint security agents may legitimately cross process boundaries. Validate publisher, deployment, target pairing, expected rights, and destination memory. Names alone are weak allowlist keys because they are easily copied.
Incident response
Isolate the endpoint according to policy, preserve volatile memory, and collect both source and target processes before destructive remediation. Reconstruct the earliest access event, identify the initial file or script, validate tokens and logons, inventory changed memory and threads, and scope the same source hash, signer, destination, and behavior across the fleet.
GitHub tools and safe lab
Use Sigma for detection-as-code, SwiftOnSecurity’s Sysmon configuration as a learning reference, Volatility 3 for memory, and PE-sieve or Moneta for suspicious mappings. Validate with synthetic SIEM events and approved debugger/profiler activity. Measure precision before enabling response automation.
ATT&CK, CVEs, and hardening
The parent technique is T1055 Process Injection; use a sub-technique only when evidence supports it. Primitive injection uses operating-system capabilities and is not itself a CVE. Any vulnerability used for initial access or privilege escalation requires separate attribution. Harden with WDAC/AppLocker, ASR, least privilege, Credential Guard, protected processes where supported, EDR tamper protection, administrative tiering, and sufficient raw telemetry retention.
Final perspective
Primitive injection is the baseline against which complex variants should be compared. Ask what changed at each stage, who caused it, and whether the destination belongs to trusted code. That method turns a long catalog of technique names into a manageable evidence problem.