T1055.001Privilege EscalationStealth
Dynamic-link Library Injection
Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process. DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
8 Sigma rules tagged T1055.001Dynamic-link Library InjectionT1055.0018 general rules
- HackTool - Potential CobaltStrike Process Injectionhightest
- ManageEngine Endpoint Central Dctask64.EXE Potential Abusehightest
- Mavinject Inject DLL Into Running Processhightest
- Renamed Mavinject.EXE Executionhightest
- Renamed ZOHO Dctask64 Executionhightest
- TAIDOOR RAT DLL Loadhightest
- CreateRemoteThread API and LoadLibrarymediumtest
- Potential DLL Injection Or Execution Using Tracker.exemediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Dynamic-link Library Injection
2 CVEs, by priority. Each link shows its badge.- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reportsMITRE CTID mapping of the KEV entry · follow-on activity98.6%Top 0.08%74.8priority
- CVE-2018-11072Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection VulnerabilityDell EMC · Dell Digital DeliveryT1055.001Dynamic-link Library InjectionMITRE CTID mapping of the CVE · primary impact0.4%Top 65%7.1priority