Lion Cipher Lab

Recognize process injection by its artifacts: the memory, threads, and handles it leaves

• Digital Forensics & IR (DFIR)
• Advanced
• ~45 min
• Free · no account required

Why it matters

Process injection is the move that defeats a process list. The attacker's code runs inside a process that already exists and is already trusted — explorer.exe, svchost.exe, the print spooler — so the process list shows only Windows components, the allow-list sees a signed Microsoft binary, and a disk scan finds no malicious file because a whole class of injection never writes the payload to disk. MITRE ATT&CK tracks it as T1055 with a dozen sub-techniques precisely because it is that common and that effective. But injected code cannot be invisible: to get in and run, it has to open the…

What you'll learn

• reading the classic injection API chain (OpenProcess -> VirtualAllocEx (RWX) -> WriteProcessMemory -> CreateRemoteThread) as one deliberate sequence, not four unrelated calls
• recognising why a memory region that is private + committed + executable + backed by no file (the malfind 'VadS + PAGE_EXECUTE_READWRITE' tell) is the durable signal of injected code
• reading a Sysmon Event ID 8 (CreateRemoteThread) record and knowing why an empty StartModule/StartFunction on the StartAddress is the giveaway
• reading a Sysmon Event ID 10 (ProcessAccess) record and understanding the suspicious cross-process handle it represents (GrantedAccess PROCESS_ALL_ACCESS)
• spotting that a legitimate, signed host process is now doing network/file things it never would, and understanding why that makes its identity untrustworthy
• contrasting the artifacts of classic remote-thread injection vs process hollowing vs APC injection, so you know which fingerprint to expect from which technique
• mapping observed artifacts to MITRE ATT&CK T1055 and its sub-techniques (.001 DLL injection, .002 PE injection, .004 APC, .012 process hollowing)
• judgment: when behavioural/API telemetry already proves injection vs when you must pull a memory image to confirm, and how a pro corroborates across telemetry, memory and process genealogy

Steps in this lab

1. What you are recognising: code running inside a process that does not own it
2. The case, and artifact 1: the classic API chain
3. Artifacts 2 and 3: the Sysmon view — the cross-process handle and the remote thread
4. Artifact 4: the durable tell — unbacked executable memory in the legitimate process
5. Artifact 5: the borrowed identity misbehaves — a desktop shell talking to the internet
6. Contrast: how the artifacts differ across injection variants
7. The third rule: when telemetry proves it, when you must pull memory, and how a pro corroborates
8. How a pro reads an injection case, in order — the habit worth keeping

Open the full interactive lab →