Thread Execution Hijacking is MITRE ATT&CK T1055.003, a Windows sub-technique of Process Injection under the Stealth and Privilege Escalation tactics. It executes arbitrary code in the address space of a separate live process.
How attackers use it
MITRE describes the technique as suspending an existing process, then unmapping or hollowing its memory, which can be replaced with malicious code or the path to a DLL. The sequence starts with a handle to a thread in the victim process, created with a native call such as OpenThread. The thread is then suspended, memory is allocated and written, the thread's context is pointed at the injected code, and the thread is resumed. The documented calls are SuspendThread, VirtualAllocEx, WriteProcessMemory, SetThreadContext and ResumeThread.
It is close to process hollowing, with one difference. Hollowing creates a new process in a suspended state. Thread execution hijacking goes after a process that is already running.
The payoff is the usual one for injection. Code runs masked under a legitimate process, with access to that process's memory and resources and possibly its privileges.
How to detect it
The record carries no data source list, but MITRE's detection strategy describes a behavioral chain within another live process's address space:
- A thread opened in a different process (OpenThread).
- Thread suspension (SuspendThread).
- Memory allocation and writing (VirtualAllocEx plus WriteProcessMemory).
- Context manipulation (SetThreadContext).
- Thread resumption (ResumeThread).
No single step is proof. Many legitimate tools, debuggers among them, use these calls. The sequence, performed by one process against another that it has no business touching, is the signal. Telemetry that records cross-process API activity is what lets you see it.
How to reduce the risk
MITRE lists Behavior Prevention on Endpoint as the mitigation. Some endpoint security products can block process injection based on common behavior sequences, including this one. Turn that capability on, run it in blocking mode where you can, and test it against your own approved tooling first so legitimate debuggers do not break.
Check your own environment
- Confirm your endpoint tool reports cross-process thread and memory activity, not only process creation.
- Review which approved programs legitimately inject or debug, so alerts have a known baseline.
- Check that detections for the five call sequence above exist and are routed to someone.
Quick check
How does thread execution hijacking differ from process hollowing?
Hollowing creates a new process in a suspended state. Thread execution hijacking targets a process that already exists.
