Lion Cipher Lab
Detect process injection from Sysmon telemetry
- SOC Analyst / Blue Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
Process injection is one of the most common ways malware hides inside a trusted, signed process to dodge naive 'is this binary bad?' checks. A SOC that cannot see it is blind to a huge slice of real intrusions. But the raw telemetry that reveals injection — every process opening a handle to every other process — is also some of the noisiest data on an endpoint, so a rule written the obvious way buries the analyst in false positives from antivirus, .NET, and the OS itself. Learning to turn that firehose into a detection that actually pages someone is the core craft of detection engineering.
What you'll learn
- Reading Sysmon ProcessAccess / CreateRemoteThread telemetry
- Mapping MITRE ATT&CK T1055 sub-techniques to observable events
- Writing detections keyed on GrantedAccess masks and source-process allowlists
- Measuring detection precision and recall against a labeled dataset
- Tuning out cross-process-access false positives (AV/EDR, CLR/JIT, csrss)
- Naming detection blind spots (module stomping, direct syscalls, thread-less injection)
Steps in this lab
- What process injection looks like from the outside
- The three Sysmon events that carry the signal
- Why the obvious rule drowns you (the judgment)
- Generate a labeled synthetic dataset
- Write two detections and score them
- Read the confusion matrix like an analyst
- Name the blind spots your telemetry cannot cover
- Where this goes next