Patchfirst
Patchfirst
T1055Privilege EscalationStealth

Process Injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via…

attack.mitre.org ↗
CVEs21
In 21
Reports1
Sub-techniques T1055.001Dynamic-link Library Injection2T1055.002Portable Executable InjectionT1055.003Thread Execution HijackingT1055.004Asynchronous Procedure CallT1055.005Thread Local StorageT1055.008Ptrace System CallsT1055.009Proc MemoryT1055.011Extra Window Memory InjectionT1055.012Process HollowingT1055.013Process DoppelgängingT1055.014VDSO HijackingT1055.015ListPlanting

Detections

37 Sigma rules tagged T1055
Process InjectionT105537 general rules
All 37 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Process Injection

21 CVEs, by priority. Each link shows its badge.
  1. CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
    Ivanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.0T1595Active ScanningT1190Exploit Public-Facing Application+4 more · 2 reports
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.02%
    85.4priority
  2. CVE-2025-31324SAP NetWeaver Unrestricted File Upload Vulnerability
    SAP · NetWeaverKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1505.003Web Shell+2 more · 1 report
    MITRE CTID mapping of the KEV entry · how it is exploited
    99.5%Top 0.06%
    83.7priority
  3. CVE-2017-1000253Linux Kernel PIE Stack Buffer Corruption Vulnerability
    Linux · KernelKEVRansomwarePublic exploitHigh · 7.8T1055Process Injection
    AI mapping from the description · primary impact
    10.7%Top 4.2%
    77.6priority
  4. CVE-2020-29574CyberoamOS (CROS) SQL Injection Vulnerability
    Sophos · CyberoamOSKEVRansomwareCritical · 9.8T1059Command and Scripting InterpreterT1055Process Injection
    MITRE CTID mapping of the KEV entry · how it is exploited
    4.7%Top 8.2%
    73.2priority
  5. CVE-2025-25257Fortinet FortiWeb SQL Injection Vulnerability
    Fortinet · FortiWebKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell+3 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    99.9%Top 0.03%
    69.9priority
  6. CVE-2024-50603Aviatrix Controllers OS Command Injection Vulnerability
    Aviatrix · ControllersKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1055Process Injection
    MITRE CTID mapping of the KEV entry · how it is exploited
    98.5%Top 0.08%
    69.8priority
  7. CVE-2024-56145Craft CMS Code Injection Vulnerability
    Craft CMS · Craft CMSKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1055Process Injection
    MITRE CTID mapping of the KEV entry · how it is exploited
    97.4%Top 0.1%
    69.8priority
  8. CVE-2024-58136Yiiframework Yii Improper Protection of Alternate Path Vulnerability
    Yiiframework · YiiKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1055Process Injection
    MITRE CTID mapping of the KEV entry · how it is exploited
    87.8%Top 0.24%
    69.8priority
  9. CVE-2025-0108Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
    Palo Alto Networks · PAN-OSKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1055Process Injection+1 more
    MITRE CTID mapping of the KEV entry · primary impact
    98.1%Top 0.09%
    69.4priority
  10. CVE-2023-34192Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
    Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitCritical · 9.0T1059Command and Scripting InterpreterT1055Process Injection+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    77.3%Top 0.44%
    69.2priority
  11. CVE-2024-6047GeoVision Devices OS Command Injection Vulnerability
    GeoVision · Multiple DevicesKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1055Process Injection
    MITRE CTID mapping of the KEV entry · how it is exploited
    10.1%Top 4.4%
    69.0priority
  12. CVE-2025-22224VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
    VMware · ESXi and WorkstationKEVHigh · 8.2T1055Process InjectionT1611Escape to Host
    MITRE CTID mapping of the KEV entry · how it is exploited
    1.6%Top 25%
    68.8priority
  13. CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
    Zyxel · DSL CPE DevicesKEVPublic exploitHigh · 8.8T1055Process InjectionT1011Exfiltration Over Other Network Medium
    MITRE CTID mapping of the KEV entry · how it is exploited
    22.9%Top 2.3%
    68.7priority
  14. CVE-2025-25181Advantive VeraCore SQL Injection Vulnerability
    Advantive · VeraCoreKEVPublic exploitHigh · 7.5T1055Process InjectionT1068Exploitation for Privilege Escalation+1 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    55.5%Top 0.96%
    68.1priority
  15. CVE-2025-1316Edimax IC-7100 IP Camera OS Command Injection Vulnerability
    Edimax · IC-7100 IP CameraKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1055Process Injection
    MITRE CTID mapping of the KEV entry · primary impact
    74.5%Top 0.51%
    64.8priority
  16. CVE-2024-40890Zyxel DSL CPE OS Command Injection Vulnerability
    Zyxel · DSL CPE DevicesKEVHigh · 8.8T1055Process InjectionT1011Exfiltration Over Other Network Medium
    MITRE CTID mapping of the KEV entry · how it is exploited
    20.7%Top 2.5%
    63.7priority
  17. CVE-2023-6548Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
    Citrix · NetScaler ADC and NetScaler GatewayKEVHigh · 8.8T1055Process Injection
    MITRE CTID mapping of the KEV entry · how it is exploited
    3.2%Top 12%
    61.8priority
  18. CVE-2025-24993Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
    Microsoft · WindowsKEVHigh · 7.8T1203Exploitation for Client ExecutionT1204User Execution+3 more
    MITRE CTID mapping of the KEV entry · primary impact
    2.2%Top 17%
    60.0priority
  19. CVE-2026-85880Microsoft Windows Heap-Based Buffer Overflow Vulnerability
    Microsoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1055Process Injection
    AI mapping from the description · primary impact
    0.4%Top 67%
    60.0priority
  20. CVE-2025-21418Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability
    Microsoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1055Process Injection+1 more
    MITRE CTID mapping of the KEV entry · primary impact
    2.1%Top 18%
    59.9priority
  21. CVE-2025-21480Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability
    Qualcomm · Multiple ChipsetsKEVHigh · 8.6T1055Process InjectionT1495Firmware Corruption
    MITRE CTID mapping of the KEV entry · how it is exploited
    0.4%Top 63%
    51.4priority

Linked through a sub-technique

2 more
  1. CVE-2015-5119Adobe Flash Player Use-After-Free Vulnerability
    Adobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reports
    98.6%Top 0.08%
    74.8priority
  2. CVE-2018-11072Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection Vulnerability
    Dell EMC · Dell Digital DeliveryT1055.001Dynamic-link Library Injection
    0.4%Top 65%
    7.1priority

Passages that support these links

↑ ↓ chooseEnter openEsc close