creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-31 16:27:43 +03:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit - 611 cybersecurity skills across all subdomains

Browse Source
This commit is contained in:
mukul975
2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/detecting-t1055-process-injection-with-sysmon/SKILL.md
+152
View File
@@ -0,0 +1,152 @@
---
name: detecting-t1055-process-injection-with-sysmon
description: Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.
domain: cybersecurity
subdomain: threat-hunting
tags: [threat-hunting, process-injection, sysmon, mitre-t1055, defense-evasion, dll-injection, process-hollowing]
version: "1.0"
author: mahipal
license: MIT
---
# Detecting T1055 Process Injection with Sysmon
## When to Use
- When hunting for defense evasion techniques that hide malicious code inside legitimate processes
- After EDR alerts for suspicious cross-process memory access or remote thread creation
- When investigating malware that injects into svchost.exe, explorer.exe, or other system processes
- During purple team exercises testing detection of process injection variants
- When validating Sysmon configuration coverage for injection detection
## Prerequisites
- Sysmon deployed with comprehensive configuration capturing Events 1, 7, 8, 10, 25
- Event ID 8 (CreateRemoteThread) enabled for remote thread detection
- Event ID 10 (ProcessAccess) configured with appropriate access mask filters
- Event ID 7 (ImageLoaded) for DLL injection detection
- Event ID 25 (ProcessTampering) for process hollowing on Sysmon 13+
- SIEM platform for correlation and alerting
## Workflow
1. **Monitor CreateRemoteThread (Event 8)**: Detect when one process creates a thread in another process's address space. This is the primary indicator of classic DLL injection and shellcode injection.
2. **Analyze ProcessAccess (Event 10)**: Track cross-process handle requests with PROCESS_VM_WRITE (0x0020), PROCESS_VM_OPERATION (0x0008), and PROCESS_CREATE_THREAD (0x0002) access rights. Legitimate processes rarely need these on other processes.
3. **Detect Anomalous DLL Loading (Event 7)**: Identify DLLs loaded from unusual paths (user temp directories, download folders) into system processes.
4. **Hunt Process Hollowing (Event 25)**: Sysmon 13+ generates ProcessTampering events when the executable image in memory diverges from what was mapped from disk -- a hallmark of process hollowing (T1055.012).
5. **Correlate with Process Creation**: Link injection events to the originating process creation (Event 1) to build the full attack chain from initial execution to injection.
6. **Filter Known-Good Cross-Process Activity**: Exclude legitimate software that performs cross-process operations (debuggers, AV products, accessibility tools, RMM agents).
7. **Map to ATT&CK Sub-Techniques**: Classify detected injection as classic injection (T1055.001), PE injection (T1055.002), thread execution hijacking (T1055.003), APC injection (T1055.004), thread local storage (T1055.005), process hollowing (T1055.012), or process doppelganging (T1055.013).
## Key Concepts
| Concept | Description |
|---------|-------------|
| T1055.001 | Dynamic-link Library Injection |
| T1055.002 | Portable Executable Injection |
| T1055.003 | Thread Execution Hijacking |
| T1055.004 | Asynchronous Procedure Call (APC) Injection |
| T1055.005 | Thread Local Storage |
| T1055.012 | Process Hollowing |
| T1055.013 | Process Doppelganging |
| T1055.015 | ListPlanting |
| Sysmon Event 8 | CreateRemoteThread detected |
| Sysmon Event 10 | ProcessAccess with memory write permissions |
| Sysmon Event 25 | ProcessTampering (image mismatch) |
| Access Mask 0x1FFFFF | PROCESS_ALL_ACCESS -- full cross-process control |
## Tools & Systems
| Tool | Purpose |
|------|---------|
| Sysmon | Primary telemetry source for injection detection |
| Process Hacker | Manual investigation of process memory regions |
| PE-sieve | Scan running processes for hollowed/injected code |
| Moneta | Detect anomalous memory regions in processes |
| Splunk / Elastic | SIEM correlation of Sysmon events |
| Volatility | Memory forensics for injection artifacts |
| Hollows Hunter | Automated scan for hollowed processes |
## Detection Queries
### Splunk -- Remote Thread Creation
```spl
index=sysmon EventCode=8
| where SourceImage!=TargetImage
| where NOT match(SourceImage, "(?i)(csrss|lsass|services|svchost|MsMpEng|SecurityHealthService|vmtoolsd)\.exe$")
| eval suspicious=if(match(TargetImage, "(?i)(svchost|explorer|lsass|winlogon|csrss|services)\.exe$"), "high_value_target", "normal_target")
| where suspicious="high_value_target"
| table _time Computer SourceImage SourceProcessId TargetImage TargetProcessId StartFunction NewThreadId
```
### Splunk -- Suspicious ProcessAccess Patterns
```spl
index=sysmon EventCode=10
| where SourceImage!=TargetImage
| where match(GrantedAccess, "(0x1FFFFF|0x1F3FFF|0x143A|0x0040)")
| where match(TargetImage, "(?i)(lsass|svchost|explorer|winlogon)\.exe$")
| where NOT match(SourceImage, "(?i)(MsMpEng|csrss|services|svchost|taskmgr|procexp)\.exe$")
| table _time Computer SourceImage TargetImage GrantedAccess CallTrace
```
### KQL -- Process Injection via Remote Thread
```kql
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "CreateRemoteThreadApiCall"
| where InitiatingProcessFileName !in~ ("csrss.exe", "lsass.exe", "services.exe", "svchost.exe")
| where FileName in~ ("svchost.exe", "explorer.exe", "lsass.exe", "winlogon.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine
```
### Sigma Rule -- Process Injection Detection
```yaml
title: Process Injection via CreateRemoteThread into System Process
status: stable
logsource:
product: windows
category: create_remote_thread
detection:
selection:
TargetImage|endswith:
- '\svchost.exe'
- '\explorer.exe'
- '\lsass.exe'
- '\winlogon.exe'
filter_legitimate:
SourceImage|endswith:
- '\csrss.exe'
- '\lsass.exe'
- '\services.exe'
- '\MsMpEng.exe'
condition: selection and not filter_legitimate
level: high
tags:
- attack.defense_evasion
- attack.t1055
```
## Common Scenarios
1. **Classic DLL Injection**: Malware uses VirtualAllocEx + WriteProcessMemory + CreateRemoteThread to load a malicious DLL into a target process. Detected via Sysmon Event 8.
2. **Process Hollowing (RunPE)**: Attacker creates a suspended process, unmaps its image, writes malicious PE, and resumes execution. Detected via Sysmon Event 25.
3. **APC Injection**: Malware queues an Asynchronous Procedure Call to threads of a target process using QueueUserAPC. Harder to detect, requires Event 10 monitoring.
4. **Reflective DLL Injection**: DLL is loaded directly from memory without touching disk, bypassing ImageLoaded detection. Requires memory-level analysis.
5. **Process Doppelganging**: Leverages NTFS transactions to replace a legitimate process image. Detected via process integrity checking.
## Output Format
```
Hunt ID: TH-INJECT-[DATE]-[SEQ]
Host: [Hostname]
Source Process: [Injecting process path]
Source PID: [Process ID]
Target Process: [Target process path]
Target PID: [Process ID]
Injection Type: [DLL/Shellcode/Hollowing/APC]
Sysmon Events: [Event IDs triggered]
Access Mask: [Granted access value]
Risk Level: [Critical/High/Medium/Low]
ATT&CK Sub-Technique: [T1055.xxx]
```
skills/detecting-t1055-process-injection-with-sysmon/assets/template.md
+30
View File
@@ -0,0 +1,30 @@
# T1055 Process Injection Hunt Template
## Hunt Metadata
| Field | Value |
|-------|-------|
| Hunt ID | TH-INJECT-YYYY-MM-DD-NNN |
| Analyst | |
| Date | |
| Status | [ ] In Progress / [ ] Complete |
## Hypothesis
> Adversaries are injecting malicious code into legitimate system processes to evade detection and execute with elevated privileges.
## Injection Findings
| # | Time | Host | Source Process | Target Process | Event Type | Access Mask | Technique | Severity |
|---|------|------|---------------|----------------|------------|-------------|-----------|----------|
| 1 | | | | | | | | |
## Process Tampering Findings
| # | Time | Host | Image | Tampering Type | Severity |
|---|------|------|-------|----------------|----------|
| 1 | | | | | |
## Recommendations
1. **Isolate**: [Affected endpoints]
2. **Analyze**: [Memory dumps of injected processes]
3. **Detect**: [New Sysmon rules for observed patterns]
4. **Harden**: [Credential Guard, PPL for LSASS]
skills/detecting-t1055-process-injection-with-sysmon/references/standards.md
+70
View File
@@ -0,0 +1,70 @@
# Standards and References - T1055 Process Injection Detection
## MITRE ATT&CK Process Injection Sub-Techniques
| Sub-Technique | Name | API Calls | Sysmon Detection |
|--------------|------|-----------|-----------------|
| T1055.001 | Dynamic-link Library Injection | VirtualAllocEx, WriteProcessMemory, CreateRemoteThread | Event 8, 10 |
| T1055.002 | Portable Executable Injection | VirtualAllocEx, WriteProcessMemory, SetThreadContext | Event 10 |
| T1055.003 | Thread Execution Hijacking | SuspendThread, SetThreadContext, ResumeThread | Event 10 |
| T1055.004 | Asynchronous Procedure Call | OpenThread, QueueUserAPC | Event 10 |
| T1055.005 | Thread Local Storage | TLS callback manipulation | Event 10 |
| T1055.012 | Process Hollowing | CreateProcess (SUSPENDED), NtUnmapViewOfSection, WriteProcessMemory | Event 25, 10 |
| T1055.013 | Process Doppelganging | NtCreateTransaction, NtCreateSection, NtRollbackTransaction | Event 25 |
| T1055.015 | ListPlanting | SendMessage to set list item text | Limited Sysmon coverage |
## Critical Sysmon Events for Injection Detection
| Event ID | Name | Detection Value |
|----------|------|----------------|
| 1 | Process Create | Baseline the originating process |
| 7 | Image Loaded | Detect DLL injection from unusual paths |
| 8 | CreateRemoteThread | Primary injection indicator |
| 10 | ProcessAccess | Cross-process handle acquisition |
| 25 | ProcessTampering | Process hollowing detection (Sysmon 13+) |
## ProcessAccess Granted Access Masks
| Access Mask | Permissions | Risk |
|-------------|------------|------|
| 0x1FFFFF | PROCESS_ALL_ACCESS | Critical - full process control |
| 0x1F3FFF | Nearly all access rights | Critical |
| 0x0040 | PROCESS_VM_READ | Medium - credential dumping |
| 0x0020 | PROCESS_VM_WRITE | High - memory modification |
| 0x0008 | PROCESS_VM_OPERATION | High - memory allocation |
| 0x0002 | PROCESS_CREATE_THREAD | High - thread creation |
| 0x143A | Combination used by Mimikatz | Critical |
## Common Injection Targets
| Process | Why Targeted |
|---------|-------------|
| svchost.exe | Many instances, network access, elevated privileges |
| explorer.exe | User context, always running, network access |
| lsass.exe | Credential access (T1003 overlap) |
| winlogon.exe | SYSTEM privileges, always running |
| spoolsv.exe | SYSTEM privileges, rarely monitored |
| dllhost.exe | COM surrogate, frequently overlooked |
| RuntimeBroker.exe | Common in modern Windows, rarely scrutinized |
## Recommended Sysmon Configuration for Injection Detection
```xml
<Sysmon schemaversion="4.90">
<EventFiltering>
<RuleGroup name="ProcessInjection" groupRelation="or">
<CreateRemoteThread onmatch="exclude">
<SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
</CreateRemoteThread>
<ProcessAccess onmatch="include">
<GrantedAccess condition="is">0x1FFFFF</GrantedAccess>
<GrantedAccess condition="is">0x1F3FFF</GrantedAccess>
<GrantedAccess condition="is">0x143A</GrantedAccess>
</ProcessAccess>
<ProcessTampering onmatch="include">
<Type condition="is">Image is replaced</Type>
</ProcessTampering>
</RuleGroup>
</EventFiltering>
</Sysmon>
```
skills/detecting-t1055-process-injection-with-sysmon/references/workflows.md
+90
View File
@@ -0,0 +1,90 @@
# Detailed Hunting Workflow - T1055 Process Injection
## Phase 1: CreateRemoteThread Detection (Sysmon Event 8)
### Step 1.1 - Identify All Remote Thread Creation
```spl
index=sysmon EventCode=8
| where SourceImage!=TargetImage
| stats count by SourceImage TargetImage Computer
| sort -count
```
### Step 1.2 - Filter to High-Value Target Processes
```spl
index=sysmon EventCode=8
| where match(TargetImage, "(?i)(svchost|explorer|lsass|winlogon|spoolsv|dllhost|RuntimeBroker)\.exe$")
| where NOT match(SourceImage, "(?i)(csrss|lsass|services|svchost|MsMpEng|vmtoolsd)\.exe$")
| stats count values(Computer) as hosts by SourceImage TargetImage
| sort -count
```
## Phase 2: ProcessAccess Analysis (Sysmon Event 10)
### Step 2.1 - High-Privilege Cross-Process Access
```spl
index=sysmon EventCode=10
| where GrantedAccess IN ("0x1FFFFF", "0x1F3FFF", "0x143A", "0x1F0FFF")
| where NOT match(SourceImage, "(?i)(MsMpEng|csrss|lsass|services|svchost|taskmgr|procexp)\.exe$")
| where match(TargetImage, "(?i)(lsass|svchost|explorer|winlogon)\.exe$")
| table _time Computer SourceImage TargetImage GrantedAccess CallTrace
```
### Step 2.2 - LSASS Access for Credential Theft
```spl
index=sysmon EventCode=10
| where match(TargetImage, "(?i)lsass\.exe$")
| where match(GrantedAccess, "(0x1FFFFF|0x1F3FFF|0x0040|0x143A)")
| where NOT match(SourceImage, "(?i)(csrss|lsass|svchost|MsMpEng|WmiPrvSE)\.exe$")
| table _time Computer SourceImage GrantedAccess CallTrace
```
## Phase 3: DLL Injection Detection (Sysmon Event 7)
### Step 3.1 - DLLs Loaded from User-Writable Paths
```spl
index=sysmon EventCode=7
| where match(ImageLoaded, "(?i)\\(temp|appdata|downloads|users\\[^\\]+\\desktop)\\")
| where match(Image, "(?i)(svchost|explorer|winlogon|services)\.exe$")
| table _time Computer Image ImageLoaded Hashes Signed
```
### Step 3.2 - Unsigned DLLs in System Processes
```spl
index=sysmon EventCode=7
| where Signed="false"
| where match(Image, "(?i)\\(svchost|services|lsass|explorer)\.exe$")
| table _time Computer Image ImageLoaded Hashes SignatureStatus
```
## Phase 4: Process Hollowing Detection (Sysmon Event 25)
### Step 4.1 - ProcessTampering Events
```spl
index=sysmon EventCode=25
| table _time Computer Image Type RuleName User
```
## Phase 5: Correlation and Investigation
### Step 5.1 - Build Full Attack Chain
```spl
index=sysmon (EventCode=1 OR EventCode=8 OR EventCode=10 OR EventCode=25)
| where match(SourceImage, "[suspected_injector]") OR match(Image, "[suspected_injector]")
| sort _time
| table _time EventCode Image SourceImage TargetImage CommandLine GrantedAccess
```
### Step 5.2 - Memory Analysis
For confirmed injection, capture process memory using:
- PE-sieve for automated scan of hollow/injected processes
- Moneta for memory region anomaly detection
- Volatility malfind plugin for offline memory forensics
## Phase 6: Response
1. Isolate affected endpoint via EDR
2. Capture memory dump before cleanup
3. Identify and remove injecting malware
4. Check for persistence mechanisms deployed by injected code
5. Sweep environment for same injection technique indicators
skills/detecting-t1055-process-injection-with-sysmon/scripts/process.py
+163
View File
@@ -0,0 +1,163 @@
#!/usr/bin/env python3
"""
T1055 Process Injection Detection Script
Analyzes Sysmon Event 8 (CreateRemoteThread), Event 10 (ProcessAccess),
and Event 25 (ProcessTampering) to identify process injection activity.
"""
import json
import csv
import argparse
import datetime
import re
from pathlib import Path
HIGH_VALUE_TARGETS = {
"svchost.exe", "explorer.exe", "lsass.exe", "winlogon.exe",
"csrss.exe", "services.exe", "spoolsv.exe", "dllhost.exe",
"runtimebroker.exe", "dwm.exe", "smss.exe",
}
LEGITIMATE_SOURCES = {
"csrss.exe", "lsass.exe", "services.exe", "svchost.exe",
"msmpe ng.exe", "securityhealthservice.exe", "vmtoolsd.exe",
"taskmgr.exe", "procexp64.exe", "procexp.exe", "procmon.exe",
}
SUSPICIOUS_ACCESS_MASKS = {
"0x1fffff": "PROCESS_ALL_ACCESS",
"0x1f3fff": "Nearly full access",
"0x143a": "Mimikatz-style access",
"0x1f0fff": "High privilege access",
"0x0040": "PROCESS_VM_READ (credential access)",
}
def parse_events(input_path: str) -> list[dict]:
"""Parse Sysmon event logs."""
path = Path(input_path)
events = []
if path.suffix == ".json":
with open(path, "r", encoding="utf-8") as f:
data = json.load(f)
events = data if isinstance(data, list) else data.get("events", [])
elif path.suffix == ".csv":
with open(path, "r", encoding="utf-8-sig") as f:
events = [dict(row) for row in csv.DictReader(f)]
return events
def detect_injection(events: list[dict]) -> list[dict]:
"""Detect process injection from Sysmon events."""
findings = []
for event in events:
event_code = str(event.get("EventCode", event.get("EventID", event.get("event_id", ""))))
computer = event.get("Computer", event.get("host", ""))
timestamp = event.get("UtcTime", event.get("_time", event.get("timestamp", "")))
user = event.get("User", event.get("user", ""))
if event_code == "8":
source = event.get("SourceImage", "")
target = event.get("TargetImage", "")
source_name = source.split("\\")[-1].lower() if source else ""
target_name = target.split("\\")[-1].lower() if target else ""
if source_name in LEGITIMATE_SOURCES:
continue
if source == target:
continue
severity = "CRITICAL" if target_name in HIGH_VALUE_TARGETS else "HIGH"
findings.append({
"timestamp": timestamp,
"computer": computer,
"event_type": "CreateRemoteThread",
"sysmon_event": 8,
"source_image": source,
"target_image": target,
"severity": severity,
"technique": "T1055.001",
"description": f"Remote thread created by {source_name} in {target_name}",
})
elif event_code == "10":
source = event.get("SourceImage", "")
target = event.get("TargetImage", "")
access = event.get("GrantedAccess", "").lower()
source_name = source.split("\\")[-1].lower() if source else ""
target_name = target.split("\\")[-1].lower() if target else ""
if source_name in LEGITIMATE_SOURCES:
continue
if source == target:
continue
if access not in SUSPICIOUS_ACCESS_MASKS:
continue
severity = "CRITICAL" if target_name == "lsass.exe" else "HIGH"
findings.append({
"timestamp": timestamp,
"computer": computer,
"event_type": "ProcessAccess",
"sysmon_event": 10,
"source_image": source,
"target_image": target,
"granted_access": access,
"access_description": SUSPICIOUS_ACCESS_MASKS.get(access, "Unknown"),
"severity": severity,
"technique": "T1055",
"description": f"{source_name} accessed {target_name} with {access} ({SUSPICIOUS_ACCESS_MASKS.get(access, '')})",
})
elif event_code == "25":
image = event.get("Image", "")
tampering_type = event.get("Type", "")
findings.append({
"timestamp": timestamp,
"computer": computer,
"event_type": "ProcessTampering",
"sysmon_event": 25,
"image": image,
"tampering_type": tampering_type,
"severity": "CRITICAL",
"technique": "T1055.012",
"description": f"Process tampering detected: {image} - {tampering_type}",
})
return sorted(findings, key=lambda x: {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2}.get(x["severity"], 3))
def run_hunt(input_path: str, output_dir: str) -> None:
"""Execute process injection detection hunt."""
print(f"[*] T1055 Process Injection Hunt - {datetime.datetime.now().isoformat()}")
events = parse_events(input_path)
print(f"[*] Loaded {len(events)} Sysmon events")
findings = detect_injection(events)
print(f"[!] Injection detections: {len(findings)}")
output_path = Path(output_dir)
output_path.mkdir(parents=True, exist_ok=True)
with open(output_path / "injection_findings.json", "w", encoding="utf-8") as f:
json.dump({
"hunt_id": f"TH-INJECT-{datetime.date.today().isoformat()}",
"total_events": len(events),
"findings_count": len(findings),
"findings": findings,
}, f, indent=2)
print(f"[+] Results written to {output_dir}")
def main():
parser = argparse.ArgumentParser(description="T1055 Process Injection Detection")
parser.add_argument("--input", "-i", required=True)
parser.add_argument("--output", "-o", default="./injection_hunt_output")
args = parser.parse_args()
run_hunt(args.input, args.output)
if __name__ == "__main__":
main()