Portable Executable injection (T1055.002) is a form of process injection on Windows. MITRE lists it under Stealth and Privilege Escalation. The goal is to run code inside the address space of a separate live process, which can evade process based defenses and may give access to that process's memory, resources and privileges.
How attackers use it
MITRE describes PE injection as commonly performed by copying code, perhaps without a file on disk, into the virtual address space of the target process, then invoking it through a new thread. The write can use native Windows API calls such as VirtualAllocEx and WriteProcessMemory, and the invocation can use CreateRemoteThread or additional code such as shellcode. Because the copied code lands at a different address, the injector also needs logic to remap memory references.
Execution is masked under a legitimate process, so a security product that only judges process names may see nothing unusual.
How to detect it
MITRE's analytic describes a behavioral sequence rather than a single event:
- One process opens a handle to another with OpenProcess.
- It allocates remote memory with VirtualAllocEx.
- It writes a PE header (MZ) or shellcode with WriteProcessMemory.
- It starts a new thread with CreateRemoteThread or NtCreateThreadEx.
The result is code running in memory without touching disk. Any one of these calls is common. The chain, from an unexpected source process into a target, is the signal. Sysmon event ID 8 (CreateRemoteThread) is a widely used telemetry source for the last step.
How to reduce the risk
MITRE lists one mitigation: behavior prevention on endpoint. Some endpoint security tools can block common sequences of behavior that occur during injection. For process injection in general, MITRE gives an example: on Windows 10, Attack Surface Reduction rules may prevent Office applications from code injection.
Quick check
Which API calls make up the classic PE injection sequence?
OpenProcess, VirtualAllocEx, WriteProcessMemory, then CreateRemoteThread or NtCreateThreadEx.
Why is a file scanner unlikely to catch it?
The code may never exist as a file on disk. It is copied straight into another process's memory.
