detecting-process-injection-techniques

检测进程注入技术

适用场景

• EDR 针对可疑 API 调用序列发出警报（VirtualAllocEx + WriteProcessMemory + CreateRemoteThread）
• 合法进程（explorer.exe、svchost.exe）出现意料之外的网络连接或文件操作
• 内存取证发现本不应包含可执行代码的内存区域中存在此类代码
• 调查恶意软件藏身于受信任进程中的就地取材攻击
• 为 EDR 或 SIEM 规则构建针对特定注入技术的检测逻辑

不要用于标准 DLL 加载分析；注入是指未经授权、在进程不配合的情况下将代码放入该进程。

前提条件

• 使用 Volatility 3 对注入痕迹进行内存取证分析
• 配置 Sysmon，启用事件 ID 8（CreateRemoteThread）和 10（ProcessAccess）
• 使用 API Monitor 或 x64dbg 实时观察注入 API 调用
• 使用 Process Hacker 或 Process Explorer 检查进程内存区域
• 了解 Windows 内存管理（VirtualAlloc、VAD、页面保护）
• 使用隔离的分析环境，安全地执行并监控恶意软件

工作流

步骤 1：通过内存取证识别注入

使用 Volatility 检测进程内存中的注入代码：

# malfind: Primary injection detection plugin
vol3 -f memory.dmp windows.malfind

# malfind detects:
# - Memory regions with PAGE_EXECUTE_READWRITE (RWX) protection
# - PE headers (MZ signature) in non-image VAD entries
# - Executable memory not backed by a file on disk

# Filter by specific process
vol3 -f memory.dmp windows.malfind --pid 852

# Dump injected memory regions for analysis
vol3 -f memory.dmp windows.malfind --dump

# Check VAD (Virtual Address Descriptor) tree for anomalies
vol3 -f memory.dmp windows.vadinfo --pid 852

# Detect hollowed processes (mapped image doesn't match disk)
vol3 -f memory.dmp windows.hollowfind

步骤 2：对注入技术进行分类

根据痕迹识别所用的注入方法：

Process Injection Techniques and Detection Artifacts:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Classic DLL Injection
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread
   Artifact: Loaded DLL in target process not present in known-good baseline
   Detection: New DLL in dlllist not matching disk hash, CreateRemoteThread event

2. Process Hollowing (RunPE)
   APIs: CreateProcess(SUSPENDED) -> NtUnmapViewOfSection -> VirtualAllocEx ->
         WriteProcessMemory -> SetThreadContext -> ResumeThread
   Artifact: Process image in memory doesn't match file on disk
   Detection: hollowfind plugin, mismatched PE headers vs disk file

3. APC Injection
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> QueueUserAPC
   Artifact: Alertable thread has queued APC pointing to injected code
   Detection: Thread start addresses outside known modules

4. Thread Hijacking
   APIs: OpenProcess -> VirtualAllocEx -> WriteProcessMemory ->
         SuspendThread -> GetThreadContext -> SetThreadContext -> ResumeThread
   Artifact: Thread instruction pointer changed to injected code
   Detection: Thread context modification, EIP/RIP outside module boundaries

5. Reflective DLL Injection
   APIs: VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread (to reflective loader)
   Artifact: DLL loaded in memory but NOT in loaded module list
   Detection: malfind (PE in non-image memory), module not in ldrmodules

6. Process Doppelganging
   APIs: NtCreateTransaction -> NtCreateFile(transacted) -> NtWriteFile ->
         NtCreateSection -> NtRollbackTransaction -> NtCreateProcessEx
   Artifact: Process created from transacted file that was rolled back
   Detection: Process with no corresponding file on disk

7. AtomBombing
   APIs: GlobalAddAtom -> NtQueueApcThread (with GlobalGetAtomName)
   Artifact: Code stored in global atom table, APC triggers copy to target
   Detection: Unusual atom table entries, APC injection indicators

步骤 3：通过 Sysmon 事件检测注入

分析 Sysmon 和 Windows 事件日志数据：

# Sysmon Event ID 8: CreateRemoteThread
# Detect when one process creates a thread in another
wevtutil qe "Microsoft-Windows-Sysmon/Operational" \
  /q:"*[System[EventID=8]]" /f:text /c:20

# Sysmon Event ID 10: ProcessAccess
# Detect suspicious access rights to other processes
# DesiredAccess containing PROCESS_VM_WRITE (0x0020) + PROCESS_CREATE_THREAD (0x0002)
wevtutil qe "Microsoft-Windows-Sysmon/Operational" \
  /q:"*[System[EventID=10]]" /f:text /c:20

# Sysmon Event ID 1: Process Creation
# Detect process hollowing via suspicious parent-child relationships
wevtutil qe "Microsoft-Windows-Sysmon/Operational" \
  /q:"*[System[EventID=1]]" /f:text /c:20

# Parse Sysmon events for injection indicators
import xml.etree.ElementTree as ET
import subprocess

# Query CreateRemoteThread events
result = subprocess.run(
    ["wevtutil", "qe", "Microsoft-Windows-Sysmon/Operational",
     "/q:*[System[EventID=8]]", "/f:xml", "/c:100"],
    capture_output=True, text=True
)

suspicious_injections = []
for event_xml in result.stdout.split("</Event>"):
    if not event_xml.strip():
        continue
    try:
        root = ET.fromstring(event_xml + "</Event>")
        ns = {"e": "http://schemas.microsoft.com/win/2004/08/events/event"}
        data = {}
        for d in root.findall(".//e:EventData/e:Data", ns):
            data[d.get("Name")] = d.text

        source = data.get("SourceImage", "")
        target = data.get("TargetImage", "")

        # Flag injections from unusual sources into system processes
        system_procs = ["svchost.exe", "explorer.exe", "lsass.exe", "winlogon.exe"]
        if any(p in target.lower() for p in system_procs):
            if not any(p in source.lower() for p in ["csrss.exe", "services.exe", "lsass.exe"]):
                print(f"[!] Suspicious injection: {source} -> {target}")
                suspicious_injections.append(data)
    except:
        pass

步骤 4：分析注入代码

检查注入载荷，了解其用途：

# Dump injected code from Volatility malfind
vol3 -f memory.dmp windows.malfind --pid 852 --dump

# Analyze the dumped region
file malfind.*.dmp

# If it contains a PE (MZ header), analyze as a standalone executable
python3 << 'PYEOF'
import pefile

# Attempt to parse as PE
try:
    pe = pefile.PE("malfind.852.0x400000.dmp")
    print("Injected PE detected!")
    print(f"  Architecture: {'x64' if pe.FILE_HEADER.Machine == 0x8664 else 'x86'}")
    print(f"  Imports:")
    if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
        for entry in pe.DIRECTORY_ENTRY_IMPORT:
            print(f"    {entry.dll.decode()}: {len(entry.imports)} functions")
except:
    print("Not a valid PE - likely shellcode")
    # Analyze as shellcode
    with open("malfind.852.0x400000.dmp", "rb") as f:
        shellcode = f.read()
    print(f"  Size: {len(shellcode)} bytes")
    print(f"  First bytes: {shellcode[:32].hex()}")
PYEOF

# Disassemble shellcode
python3 -c "
from capstone import Cs, CS_ARCH_X86, CS_MODE_64
with open('malfind.852.0x400000.dmp', 'rb') as f:
    code = f.read()[:256]
md = Cs(CS_ARCH_X86, CS_MODE_64)
for insn in md.disasm(code, 0x400000):
    print(f'  0x{insn.address:X}: {insn.mnemonic} {insn.op_str}')
"

# Scan with YARA for known payloads
vol3 -f memory.dmp yarascan.YaraScan --pid 852 --yara-file malware_rules.yar

步骤 5：映射到 MITRE ATT&CK

在 ATT&CK 框架中对检测到的技术进行分类：

MITRE ATT&CK Process Injection Sub-Techniques (T1055):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
T1055.001  Dynamic-link Library Injection
T1055.002  Portable Executable Injection
T1055.003  Thread Execution Hijacking
T1055.004  Asynchronous Procedure Call (APC)
T1055.005  Thread Local Storage
T1055.008  Ptrace System Calls (Linux)
T1055.009  Proc Memory (/proc/pid/mem - Linux)
T1055.011  Extra Window Memory Injection
T1055.012  Process Hollowing
T1055.013  Process Doppelganging
T1055.014  VDSO Hijacking (Linux)
T1055.015  ListPlanting

步骤 6：创建检测特征

针对已识别的技术编写检测规则：

# Sigma rule for CreateRemoteThread injection
title: Suspicious CreateRemoteThread into System Process
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 8
        TargetImage|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\lsass.exe'
    filter:
        SourceImage|endswith:
            - '\csrss.exe'
            - '\services.exe'
            - '\svchost.exe'
    condition: selection and not filter
level: high

核心概念

术语	定义
进程注入	在另一个进程的地址空间中执行代码的技术，通常用于规避检测并继承目标进程的信任级别
进程空洞化	在挂起状态下创建合法进程，解除映射其内存，写入恶意代码，然后恢复执行，以伪装成合法进程
反射式 DLL 注入	不使用 Windows 加载器，将 DLL 加载到进程内存中，因此该 DLL 不会出现在已加载模块列表中
APC 注入	向目标进程中的线程排队异步过程调用，使线程在进入可警报状态时执行注入代码
VAD（虚拟地址描述符）	描述进程内存区域的 Windows 内核结构；异常的 VAD 条目（RWX 权限、非映像 PE）表示存在注入
CreateRemoteThread	在另一个进程中创建线程的 Windows API；这是经典 DLL 注入及许多其他注入技术的主要机制
PAGE_EXECUTE_READWRITE	允许读取、写入和执行的内存保护；合法应用很少使用，是注入代码的常见标志

工具与系统

• Volatility (malfind)：内存取证插件，通过 VAD 分析和扫描非映像内存区域中的 PE 标头来检测注入代码
• Sysmon：系统监视器，提供详细的 Windows 事件日志，包括 CreateRemoteThread（EID 8）和 ProcessAccess（EID 10）
• Process Hacker：高级进程管理工具，可显示详细的内存区域、线程堆栈和注入模块
• API Monitor：用于监控并记录进程 API 调用的 Windows 工具，可实时观察注入序列
• pe-sieve：扫描运行中进程，以查找代码注入、挂钩和空洞化迹象的工具

常见场景

场景：调查被掏空的 svchost.exe 进程

背景：EDR 检测到 svchost.exe 正在与外部 IP 建立 HTTPS 连接。svchost.exe 应该只与 Microsoft 服务通信。需要进行内存分析以确认进程掏空。

方法：

1. 获取可疑 svchost.exe 进程的内存转储
2. 运行 Volatility malfind，检测进程内存中是否有注入的 PE
3. 将内存映像基址与磁盘上的 svchost.exe 文件哈希进行比较
4. 检查进程的父进程（应该是 services.exe）和创建参数
5. 从内存中转储被掏空的可执行文件，并使用 Ghidra 进行分析
6. 运行 netscan，确认被掏空进程的网络连接
7. 使用 YARA 扫描转储的代码，以识别恶意软件家族

注意事项：

• 假设所有 svchost.exe 实例都相同（每个实例加载的服务 DLL 不同）
• 未检查父进程（被掏空的进程通常有错误的父进程）
• 仅依赖进程名称匹配（攻击者专门针对 svchost.exe，因为系统中通常会有多个实例）
• 忽略可能已终止的注入源进程

输出格式

PROCESS INJECTION ANALYSIS REPORT
====================================
Dump File:        memory.dmp
Analysis Tool:    Volatility 3.2 + Sysmon

INJECTION DETECTED
Target Process:   svchost.exe (PID: 852)
Source Process:    malware.exe (PID: 2184) [terminated]
Technique:        Process Hollowing (T1055.012)

EVIDENCE
malfind Results:
  PID 852 (svchost.exe):
    Address: 0x00400000
    Size:    184,320 bytes
    Protection: PAGE_EXECUTE_READWRITE
    Header: MZ (PE32 executable)
    NOT backed by disk file

Process Verification:
  Expected Image: C:\Windows\System32\svchost.exe (SHA-256: aaa...)
  In-Memory Image: Unknown PE (SHA-256: bbb...)
  Result: MISMATCH - HOLLOWED PROCESS

Sysmon Events:
  [4688] malware.exe (PID 2184) created svchost.exe (PID 852) SUSPENDED
  [10]   malware.exe accessed svchost.exe with PROCESS_VM_WRITE
  [8]    malware.exe created remote thread in svchost.exe

INJECTED PAYLOAD ANALYSIS
SHA-256:          bbb123def456...
YARA Match:       CobaltStrike_Beacon_x64
Type:             Cobalt Strike Beacon (HTTP)
C2:               hxxps://185.220.101[.]42/updates

MITRE ATT&CK
T1055.012  Process Hollowing
T1071.001  Web Protocols (HTTPS C2)
T1036.005  Match Legitimate Name (svchost.exe)