sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
NotPetya creates a task to reboot the system one hour after infection.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Okrum's installer can attempt to achieve persistence by creating a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
OopsIE creates a scheduled task to run itself every three minutes.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
POWERSTATS has established persistence through a scheduled task using the command `”C:\Windows\system32\schtasks.exe” /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR “c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe”`.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
POWRUNER persists through a scheduled task that executes it every minute.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
PowerSploit's `New-UserPersistenceOption` Persistence argument can be used to establish via a Scheduled Task/Job.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Prestige has been executed on a target system through a scheduled task created by Sandworm Team using Impacket.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Pteranodon schedules tasks to invoke its components in order to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
QakBot has the ability to create scheduled tasks for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
RTM tries to add a scheduled task to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
RainyDay can use scheduled tasks to achieve persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Ramsay can schedule tasks via the Windows COM API to maintain persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Remexi utilizes scheduled tasks as a persistence mechanism.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
RemoteCMD can execute commands remotely by creating a new schedule task on the remote system
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Revenge RAT schedules tasks to run malicious scripts at different intervals.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Ryuk can remotely create a scheduled task to execute itself on a system.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
SQLRat has created scheduled tasks in `%appdata%\Roaming\Microsoft\Templates\`.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
SVCReady can create a scheduled task named `RecoveryExTask` to gain persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Saint Bot has created a scheduled task named "Maintenance" to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
ServHelper contains modules that will use schtasks to carry out malicious operations.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
SharpDisco can create scheduled tasks to execute reverse shells that read and write data to and from specified SMB shares.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
SharpStage has a persistence component to write a scheduled task for the payload.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Sibot has been executed via a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Smoke Loader launches a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
SoreFang can gain persistence through use of scheduled tasks.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Stuxnet schedules a network job to execute two minutes after host infection.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Tarrask is able to create “hidden” scheduled tasks for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Tomiris has used `SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR "[path to self]" /ST 10:00` to establish persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
TrickBot creates a scheduled task on the system that provides persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
Zebrocy has a command to create a scheduled task for persistence.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
ZxxZ has used scheduled tasks for persistence and execution.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
ccf32 can run on a daily basis using a scheduled task.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
schtasks is used to schedule tasks on a Windows system to run at a specific date and time.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
yty establishes persistence by creating a scheduled task with the command `SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“`.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
zwShell has used SchTasks for execution.
Technique: T1053.005 Scheduled Task/Job: Scheduled Task, Tactic: TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation
During the 2015 Ukraine Electric Power Attack, Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During Cutting Edge, threat actors used malicious SparkGateway plugins to inject shared objects into web process memory on compromised Ivanti Secure Connect VPNs to enable deployment of backdoors.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
APT37 injects its malware variant, ROKRAT, into the cmd.exe process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its functionality.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Group has injected code into trusted processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PLATINUM has used various methods of process injection including hot patching.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
TA2541 has injected malicious code into legitimate .NET related processes including  regsvcs.exe, msbuild.exe, and installutil.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Turla has also used PowerSploit's `Invoke-ReflectivePEInjection.ps1` to reflectively load a PowerShell payload into a random process on the victim system.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Wizard Spider has used process injection to execute payloads to escalate privileges.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ABK has the ability to inject shellcode into svchost.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ANDROMEDA can inject into the `wuauclt.exe` process to perform C2 actions.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Agent Tesla can inject into known, vulnerable binaries on targeted hosts.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
AuditCred can inject code from files to other running processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Avenger has the ability to inject shellcode into svchost.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BADHATCH can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BBK has the ability to inject shellcode into svchost.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Backdoor.Oldrea injects itself into explorer.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bazar can inject code through calling `VirtualAllocExNuma`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bumblebee can inject code into multiple processes on infected endpoints.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
COATHANGER includes a binary labeled `authd` that can inject a library into a running process and then hook an existing function within that process with a new function from that library.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cardinal RAT injects into a newly spawned process created from a native Windows executable.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Clambling can inject into the `svchost.exe` process for execution.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
CostaBricks can inject a payload into the memory of a compromised host.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Donut includes a subproject `DonutTest` to inject shellcode into a target process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Dyre has the ability to directly inject its code into the web browser process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Egregor can inject its payload into iexplore.exe process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Empire contains multiple modules for injecting into processes, such as `Invoke-PSInject`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Gazer injects its communication module into an Internet accessible process through which it performs C2.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
HOPLIGHT has injected into running processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
HTRAN can inject into into running processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
HyperBro can run shellcode it injects into a newly created process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
JHUHUGIT performs code injection injecting its own functions to browser processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
JPIN can inject content into lsass.exe to load a module.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Lizar can migrate the loader into another process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Mis-Type has been injected directly into a running process, including `explorer.exe`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Mispadu's binary is injected into memory via `WriteProcessMemory`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
NavRAT copies itself into a running Internet Explorer process to evade detection.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Ninja has the ability to inject an agent module into a new process and arbitrary shellcode into running processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Pandora can start and inject code into a new `svchost` process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PoshC2 contains multiple modules for injecting into processes, such as `Invoke-PSInject`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
QakBot can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
REvil can inject itself into running processes on a compromised host.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Remcos has a command to hide itself through injecting into another process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Ryuk has injected itself into remote processes to encrypt files using a combination of `VirtualAlloc`, `WriteProcessMemory`, and `CreateRemoteThread`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SLOTHFULMEDIA can inject into running processes on a compromised host.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ShadowPad has injected an install module into a newly created process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Sliver can inject code into local and remote processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Smoke Loader injects into the Internet Explorer process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
TrickBot has used `Nt*` Native API functions to inject code into legitimate processes such as `wermgr.exe`.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Waterbear can inject decrypted shellcode into the LanmanServer service.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Wiarp creates a backdoor through which remote attackers can inject files into running processes.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Wingbird performs multiple process injections to hijack system processes and execute malicious code.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
metaMain can inject the loader file, Speech02.db, into a process.
Technique: T1055 Process Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
A Lazarus Group malware sample performs reflective DLL injection.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Malteiro has injected Mispadu’s DLL into a process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
TA505 has been seen injecting a DLL into winword.exe.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BADHATCH has the ability to execute a malicious DLL by injecting into `explorer.exe` on a compromised machine.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BlackEnergy injects its DLL component into svchost.exe.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Carberp's bootkit can inject a malicious DLL into the address space of running processes.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Carbon has a command to inject code into a process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Strike has the ability to load DLLs via reflective injection.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Conti has loaded an encrypted DLL into memory and then executes it.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
DarkTortilla can use a .NET-based DLL named `RunPe6` for process injection.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Derusbi injects itself into the secure shell (SSH) process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Dyre injects into other processes to load modules.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Elise injects DLL files into iexplore.exe.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Emissary injects its DLL file into a newly spawned Internet Explorer process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Emotet has been observed injecting in to Explorer.exe and other processes.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Gelsemium has the ability to inject DLLs into specific processes.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Get2 has the ability to inject DLLs into processes.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
HIDEDRV injects a DLL for Downdelph into the explorer.exe process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Heyoka Backdoor can inject a DLL into rundll32.exe for execution.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
IronNetInjector has the ability to inject a DLL into running processes, including the IronNetInjector DLL into explorer.exe.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Koadic can perform process injection by using a reflective DLL.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Lizar has used the PowerKatz plugin that can be loaded into the address space of a PowerShell process through reflective DLL loading.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Maze has injected the malware DLL into a target process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
MegaCortex loads `injecthelper.dll` into a newly created `rundll32.exe` process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Mongall can inject a DLL into `rundll32.exe` for execution.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PS1 can inject its payload DLL Into memory.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PipeMon can inject its modules into various processes using reflective DLL loading.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PoisonIvy can inject a malicious DLL into a process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Pupy can migrate into another process using reflective DLL injection.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
RATANKBA performs a reflective DLL injection using a given pid.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Ramsay can use `ImprovedReflectiveDLLInjection` to deploy components.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Remsec can perform DLL injection.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Saint Bot has injected its DLL component into `EhStorAurhn.exe`.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ShadowPad has injected a DLL into svchost.exe.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Socksbot creates a suspended svchost process and injects its DLL into it.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SombRAT can execute `loadfromfile`, `loadfromstorage`, and `loadfrommem` to inject a DLL  from disk, storage, or memory respectively.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Taidoor can perform DLL loading.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
TajMahal has the ability to inject DLLs for malicious plugins into running processes.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Uroburos can use DLL injection to load embedded files and modules.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ZxShell is injected into a shared SVCHOST process.
Technique: T1055.001 Process Injection: Dynamic-link Library Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.
Technique: T1055.002 Process Injection: Portable Executable Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.
Technique: T1055.002 Process Injection: Portable Executable Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Carbanak downloads an executable and injects it directly into a new process.
Technique: T1055.002 Process Injection: Portable Executable Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
GreyEnergy has a module to inject a PE binary into a remote process.
Technique: T1055.002 Process Injection: Portable Executable Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
InvisiMole can inject its backdoor as a portable executable into a target process.
Technique: T1055.002 Process Injection: Portable Executable Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Lizar can execute PE files in the address space of the specified process.
Technique: T1055.002 Process Injection: Portable Executable Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.
Technique: T1055.002 Process Injection: Portable Executable Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.
Technique: T1055.003 Process Injection: Thread Execution Hijacking, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the `ResumeThread` API.
Technique: T1055.003 Process Injection: Thread Execution Hijacking, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Waterbear can use thread injection to inject shellcode into the process of security software.
Technique: T1055.003 Process Injection: Thread Execution Hijacking, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
FIN8 has injected malicious code into a new svchost.exe process.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BADHATCH can inject itself into a new `svchost.exe -k netsvcs` process using the asynchronous procedure call (APC) queue.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
IcedID has used `ZwQueueApcThread` to inject itself into remote processes.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
InvisiMole can inject its code into a trusted process via the APC queue.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Sardonic can use the `QueueUserAPC` API to execute shellcode on a compromised machine.
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."
Technique: T1055.004 Process Injection: Asynchronous Procedure Call, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Ursnif has injected code into target processes via thread local storage callbacks.
Technique: T1055.005 Process Injection: Thread Local Storage, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
PACEMAKER can use PTRACE to attach to a targeted process to read process memory.
Technique: T1055.008 Process Injection: Ptrace System Calls, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.
Technique: T1055.011 Process Injection: Extra Window Memory Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.
Technique: T1055.011 Process Injection: Extra Window Memory Injection, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Gorgon Group malware can use process hollowing to inject one of its trojans into another process.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
TA2541 has used process hollowing to execute CyberGate malware.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
A Threat Group-3390 tool can spawn `svchost.exe` and inject the payload into that process.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Clambling can execute binaries through process hollowing.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Strike can use process hollowing for execution.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
DarkGate leverages process hollowing techniques to evade detection, such as decrypting the content of an encrypted PE file and injecting it into the process vbc.exe.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Dtrack has used process hollowing shellcode to target a predefined list of processes from `%SYSTEM32%`.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Duqu is capable of loading executable code via process hollowing.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Lokibot has used process hollowing to inject itself into legitimate Windows process.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
QakBot can use process hollowing to execute its main payload.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
RCSession can launch itself from a hollowed svchost.exe process.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Snip3 can use RunPE to execute malicious payloads within a hollowed Windows process.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
TrickBot injects into the svchost.exe process.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Ursnif has used process hollowing to inject into child processes.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation