// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Techniques › T1055
Technique T1055

Process Injection

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
Process Injection (T1055) — a Defense Evasion technique, observed in public incident reporting.
MITRE ATT&CKT1055
TacticDefense Evasion
Incidents on file25

Detection & mitigation

Monitor for suspicious process injections (e.g., CreateRemoteThread, NtCreateThreadEx) from scripting hosts like wscript.exe or cscript.exe into other processes. Deploy endpoint detection rules for known LokiBot indicators and block execution of obfuscated JScript attachments.

Observed in the wild

2026-06-25
process injection
LokiBot Campaign Uses JScript, .NET Injector, and Process Injection to Steal Credentials
2026-06-25
process injection
StrikeShark Campaign Deploys Cobalt Strike via SharkLoader Malware
2026-06-25
process injection
Mistic Backdoor Deployed by KongTuke Access Broker Targets Enterprise Networks
2026-06-01
process injection
Fake Purchase Order Emails Deliver Fileless PureLogs Malware via Process Hollowing
2026-05-22
process injection
Lazarus Group Deploys RemotePE RAT in Memory-Only Attacks
2025-11-05
process injection
TNFBypass Tool Released to Bypass TNFlash.exe Verification in TN ROM 3.x
2025-08-14
process injection
Proof-of-Concept Tool Bypasses Chrome App-Bound Encryption to Extract Browser Secrets
2025-07-24
process injection
Updated DLL Injection Tool Bypasses Respondus LockDown Browser Protections
2025-07-24
process injection
Researchers demonstrate EDR bypass using process hollowing, DLL unhooking, and syscall obfuscation
2025-06-25
process injection
Research Demonstrates Multi-Layered Techniques to Bypass Windows Defender for Metasploit Payloads
2025-05-22
process injection
Novel Process Injection Technique Evades EDR by Skipping Memory Allocation and Write Steps
2025-03-05
process injection
Two EDR Evasion Techniques Tested Against CrowdStrike: Python Shellcode Execution and Go Reverse SSH Tunnel
2024-10-29
process injection
PoC Exploit for CVE-2024-0311 Skyhigh Client Proxy Bypass
2024-10-27
process injection
Windows API Memory Injection Technique Bypasses EDR and AV
2024-10-15
process injection
Outflank Introduces Early Cascade Injection Process Injection Technique
2024-06-18
process injection
Proof-of-Concept Tool Bypasses Pearson LockDown Browser VM Detection
2024-04-26
process injection
Research Demonstrates RASP Bypass in Java via Process Injection
2023-12-06
process injection
Pool Party Process Injection Techniques Bypass Major EDR Solutions
2023-11-18
process injection
Process Stomping: Injecting Shellcode into RWX Sections of Executables
2023-11-16
process injection
Apache ActiveMQ Exploit Enables Stealthy EDR Bypass
2023-11-16
process injection
Evading Windows Defender with MiniDumpWriteDump, Donut, and Process Injection
2023-10-28
process injection
PayloadInResources: AV Bypass via Resource-Stored XOR-Encrypted Shellcode
2023-08-21
process injection
Percino: Evasive Golang Loader Using Process Hollowing to Bypass EDR
2023-08-02
process injection
EDR Whitelist Bypass Allows Undetected Malicious Activity via PPID Spoofing
2023-06-28
process injection
Mockingjay Process Injection Technique Evades EDR by Abusing DLLs with Default RWX Sections

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →