MITRE ATT&CK technique · stealth, Privilege Escalation

`T1055.002` Portable Executable Injection

Sub-technique of T1055 Process Injection

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

GootLoader

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.