Asynchronous procedure call (APC) injection is MITRE ATT&CK T1055.004. It affects Windows and is listed under Stealth and Privilege Escalation. It is one of the ways adversaries run code inside a separate live process.
How attackers use it
An APC is a function queued to a thread. Queued APC functions run when the thread enters an alertable state. MITRE describes APC injection as attaching malicious code to a thread's APC queue. A handle to the victim is first created with native calls such as OpenThread, and then QueueUserAPC can invoke a function, for example one that loads a malicious DLL.
MITRE documents two variations by name:
- Early Bird injection creates a suspended process so that code can be written and run before the process entry point, and potentially before later anti-malware hooks, via an APC.
- AtomBombing uses APCs to invoke malicious code previously written to the global atom table.
As with other injection methods, code running inside a trusted process may reach its memory, its system and network resources, and possibly higher privileges.
How to detect it
MITRE's detection strategy is behavioral. It looks for memory allocation, remote thread queuing through an APC (for example QueueUserAPC), and altered thread context inside another live process, which together execute unauthorized code under a legitimate context.
Useful questions to ask of your telemetry:
- Which processes call APC queuing functions on threads they did not create?
- Which newly created processes start suspended and then have memory written into them?
- Do those parent and child pairs make sense for your software?
How to reduce the risk
The mitigation MITRE lists is Behavior Prevention on Endpoint. Some security tools block process injection based on common behavior sequences. Make sure Windows endpoints run one with blocking enabled, and review its coverage when the vendor adds new injection patterns.
Check your own environment
- Confirm your endpoint product lists APC based injection among the behaviors it blocks or alerts on.
- Check that suspended process creation followed by memory writes generates an alert.
- Keep a short list of approved software that legitimately queues APCs across processes.
Quick check
What makes Early Bird injection different?
It runs injected code in a suspended process before the entry point, which may be ahead of anti-malware hooks.
