Hunting process injection with sysmon

Hunting Process Injection with Sysmon

When to Use

• You have Sysmon (or equivalent EDR) telemetry and want to hunt code injection across hosts.
• You are testing a hypothesis that an implant injects into benign processes (explorer.exe, svchost.exe) to evade defenses.
• You need to triage EID 8/10 events into a prioritized list of injection candidates.

Do not use EID 8/10 in isolation as a verdict — legitimate software (security tools, debuggers, injectors in dev tools) generates these; correlation and baselining are required.

Prerequisites

• Sysmon configured to log Event ID 8 (CreateRemoteThread) and 10 (ProcessAccess) with useful access masks; a SIEM or log export to query.
• A baseline of normal cross-process access for your environment.

Workflow

Step 1: Pull the candidate events

Collect EID 8 (remote thread creation) and EID 10 (process access) with high-power access masks (e.g., 0x1F0FFF, PROCESS_VM_WRITE | PROCESS_CREATE_THREAD).

Step 2: Filter known-good

Remove baseline noise: security agents, legitimate debuggers, and known injector pairs. Keep unusual source→target pairs (e.g., a document app injecting into a browser).

python scripts/analyst.py triage sysmon.json

Step 3: Correlate signals

Raise priority when multiple indicators stack: cross-process write + remote thread into the same target, target with RWX private memory, or source process spawned from a macro/script.

Step 4: Pivot per candidate

For top candidates, pull the source process tree, image path, signing status, and network connections to confirm or clear.

Step 5: Confirm and respond

Validate suspected hollowing/shellcode (memory analysis), then escalate confirmed injections to IR and convert the logic into a detection rule.

Validation

• Surfaced candidates show a coherent injection pattern (access + remote thread to same PID), not isolated single events.
• Known-good injectors are filtered, keeping the candidate list small and reviewable.
• Confirmed cases are corroborated by process lineage or memory evidence.

Pitfalls

• Alerting on every EID 10 — the access mask matters; filter to write/inject rights.
• Ignoring source lineage; a script-spawned source is far more suspicious.
• No baseline, so security tooling buries real injection in noise.

References

• See references/api-reference.md for the Sysmon triage helper.
• Sysmon docs and ATT&CK T1055 (linked in frontmatter).