Anthropic-Cybersecurity-Skills/skills/detecting-t1055-process-injection-with-sysmon/assets/template.md

T1055 Process Injection Hunt Template

Hunt Metadata

Field	Value
Hunt ID	TH-INJECT-YYYY-MM-DD-NNN
Analyst
Date
Status	[ ] In Progress / [ ] Complete

Hypothesis

Adversaries are injecting malicious code into legitimate system processes to evade detection and execute with elevated privileges.

Injection Findings

#	Time	Host	Source Process	Target Process	Event Type	Access Mask	Technique	Severity
1

Process Tampering Findings

#	Time	Host	Image	Tampering Type	Severity
1

Recommendations

1. Isolate: [Affected endpoints]
2. Analyze: [Memory dumps of injected processes]
3. Detect: [New Sysmon rules for observed patterns]
4. Harden: [Credential Guard, PPL for LSASS]