Fileless malware and process injection techniques execute entirely in memory, leaving no file artefacts on disk for traditional antivirus to scan. Attackers inject shellcode or reflective DLLs into legitimate processes — notepad.exe, svchost.exe, explorer.exe — to inherit their trust and blend into normal system activity. Process hollowing replaces a legitimate process image with malicious code before execution begins. PPID spoofing forges the parent process ID so that a malicious process appears to be spawned from a trusted parent.
Key data sources: DeviceEvents (CreateRemoteThreadApiCall, InjectIntoProcess action types from MDE), DeviceProcessEvents (anomalous parent-child relationships), Sysmon Event 8 (CreateRemoteThread — if Sysmon deployed).
☰ Table of Contents
01 — BACKGROUND
TECHNIQUE OVERVIEWProcess injection is the foundation of most advanced persistent threat campaigns because it evades file-based detection entirely. The attacker's code runs inside a legitimate, signed, trusted process — the malicious behaviour is attributed to that process, not to any file on disk. MDE detects injection events via kernel-level hooks on Windows APIs (NtCreateThreadEx, VirtualAllocEx, WriteProcessMemory, NtMapViewOfSection) and reports them as DeviceEvents with injection-typed ActionTypes.
| Field | Value |
|---|---|
| MITRE Techniques | T1055 — Process Injection (parent) T1055.001 — Dynamic-link Library Injection T1055.012 — Process Hollowing T1134.004 — Access Token Manipulation: Parent PID Spoofing |
| Kill-chain Phase | Defense Evasion, Privilege Escalation |
| Primary Log Source | DeviceEvents (MDE) — injection ActionTypes |
| Secondary Log Sources | DeviceProcessEvents (parent-child anomalies), Sysmon Event 8 (CreateRemoteThread), SecurityEvent 4656 (handle request on process) |
| Common Injection Targets | svchost.exe, explorer.exe, notepad.exe, lsass.exe, dllhost.exe, msiexec.exe |
| Default Severity | SEV1 if injecting into lsass.exe; SEV2 for other targets pending investigation |
Injection into lsass.exe is always SEV1 regardless of other context — it indicates credential dumping in progress (cross-reference SOP-27). Do not wait for further evidence before isolating.
02 — IDENTIFICATION
2 INDICATORSMDE reports process injection at the kernel API level via DeviceEvents. CreateRemoteThreadApiCall, InjectIntoProcess, and ProcessInjection ActionTypes indicate an attacker's process is writing code into another process's memory space and executing it. This is the primary indicator for Cobalt Strike beacon injection, Meterpreter reflective DLL loading, and process hollowing.
- 1Open Advanced Hunting and run the DeviceEvents query below. Set time range to Last 1 hour.
- 2For each result, note the FileName (injecting process) and ProcessId (target process). Navigate to the Device Timeline and filter on that ProcessId to see all activity of the injected process.
- 3If the target process is
lsass.exe— escalate to SEV1 immediately and cross-reference SOP-27 (credential dumping). - 4Check whether the injecting process has a file on disk: query
DeviceFileEvents | where FileName == "<injecting process>". Absence of a file on disk with an active process = fileless execution confirmed. - 5Navigate to Incidents & alerts → Alerts to check if MDE has already auto-classified this as a process injection alert.
| ActionType / Indicator | Meaning | Severity |
|---|---|---|
| CreateRemoteThreadApiCall | CreateRemoteThread API called — classic DLL injection or shellcode injection mechanism | CRITICAL |
| InjectIntoProcess | MDE-classified injection event — code injected into remote process address space | CRITICAL |
| ProcessInjection | Generic injection detection — includes VirtualAllocEx + WriteProcessMemory patterns | HIGH |
| NtMapViewOfSection injection | Section-based injection (Process Doppelganging / transacted hollowing) | CRITICAL |
| Target: lsass.exe | Injection into LSASS — credential dumping in progress (also see SOP-27) | CRITICAL |
| Target: svchost.exe / explorer.exe | Injection into common host processes for C2 beacon hiding | HIGH |
| No file on disk for injecting process | Shellcode-only execution — no binary exists, payload lives entirely in memory | CRITICAL |
Process hollowing creates processes that appear legitimate from the outside but execute malicious code. PPID spoofing creates a process with a spoofed parent — e.g. a malicious process spawning cmd.exe while making it appear to come from explorer.exe. These techniques defeat parent-process-based detection rules. Anomalous parent-child chains (Office spawning PowerShell, notepad spawning cmd) are the most reliable behavioral indicator when direct injection telemetry is unavailable.
- 1Open the Device Timeline for the affected host. Filter by Process events. Look for Office applications (winword.exe, excel.exe) spawning cmd.exe, powershell.exe, wscript.exe, or mshta.exe.
- 2Run the Advanced Hunting KQL query below to find unexpected parent-child relationships across the fleet.
- 3For PPID spoofing: check whether the InitiatingProcessParentFileName and the actual InitiatingProcessId match a currently running process. A mismatched PID (spoofed parent no longer running at that PID) is a strong PPID spoof indicator.
- 4Check whether a process with a legitimate name (notepad.exe, calc.exe) is making network connections — this almost always indicates process hollowing where the legitimate image was replaced with C2 shellcode.
- 5Cross-reference with DeviceNetworkEvents — a svchost.exe instance connecting to a non-Microsoft IP on port 443/4444/8080/8443 immediately after an injection event is a confirmed C2 beacon.
| Parent Process | Unexpected Child | Likely Technique |
|---|---|---|
| winword.exe / excel.exe / outlook.exe | cmd.exe, powershell.exe, wscript.exe, mshta.exe | Malicious macro / phishing initial access |
| notepad.exe / calc.exe / mspaint.exe | Any network connection outbound | Process hollowing — legitimate image replaced |
| svchost.exe (non-SYSTEM) | cmd.exe / powershell.exe with encoded command | Shellcode injection into svchost |
| explorer.exe | cmd.exe → powershell.exe with -EncodedCommand | PPID spoofing from injected explorer |
| Any process | Spawned process PID does not match InitiatingProcessId in records | PPID spoofing via UpdateProcThreadAttribute |
PPID spoofing is confirmed when InitiatingProcessParentFileName says "explorer.exe" but the process tree in Device Timeline shows the true creator was a recently spawned, short-lived cmd.exe. Always verify the actual process tree in MDE Device Timeline — do not rely solely on parent name fields.
03 — CONTAINMENT
IMMEDIATE ACTIONCollect a memory image (RAM dump) via MDE Live Response BEFORE network isolation. Process injection leaves no disk artefacts — the injected shellcode exists only in memory. Rebooting or isolating first destroys all forensic evidence.
- 1Open the device in Assets → Devices. Click Actions → Initiate Live Response.
- 2In the Live Response terminal, run
processesto capture the full running process list with PIDs before any changes. - 3Collect a memory image: upload and run an approved memory acquisition tool (e.g. winpmem). Run
run winpmem.exe -o memory.dmpand retrieve the file viagetfile memory.dmp. - 4After memory acquisition: return to the device page and click Actions → Isolate Device → Full Isolation.
- 5Pass the memory image to the forensics analyst for Volatility analysis — look for injected PE headers, hollowed process regions, and C2 shellcode stagers in memory.
04 — ERADICATION
CLEANUP- 1Analyse the memory image with Volatility3: run
vol -f memory.dmp windows.malfindto identify injected code regions (PAGE_EXECUTE_READWRITE with PE headers — strong injection indicator). - 2Identify the initial access vector from the parent process chain — phishing document, RDP session, vulnerable web application. Remediate the initial access point before re-connecting the host.
- 3Search for C2 infrastructure IOCs (IP, domain, certificate SHA1) extracted from the memory image and block them at the firewall and DNS layer fleet-wide.
- 4Re-image the endpoint from a known-good baseline — fileless malware frequently establishes persistence via registry run keys, scheduled tasks, or WMI subscriptions (cross-reference SOP-26 and SOP-30).
- 5Audit all credentials that may have been accessed on this host — force password resets for all accounts that authenticated to the affected device.
- 6Add confirmed C2 IPs/domains as Threat Intelligence Indicators in Sentinel and MDE to auto-block across the fleet.
05 — ESCALATION
ESCALATION PATHS| Condition | Severity | Action | Notify |
|---|---|---|---|
| Injection into lsass.exe confirmed | SEV1 | Memory dump → isolate → escalate to SOP-27 | SOC Lead → CISO |
| C2 beacon confirmed (network connection from injected process) | SEV1 | Memory dump → isolate → block C2 IOCs fleet-wide | SOC Lead → CISO → IR Team |
| Injection into svchost / explorer with lateral movement | SEV1 | Isolate, check all hosts in same subnet | SOC Lead → CISO |
| Anomalous parent-child, no confirmed injection | SEV2 | Investigate process chain, prepare isolation | SOC Lead |
| Security tool self-injection (CrowdStrike / AV) | FP | Whitelist process hash, close with documentation | L3 Analyst |
Stay Threat-Ready
Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.