Thread Local Storage (TLS) callback injection is MITRE ATT&CK T1055.005, a Windows sub-technique of Process Injection. It sits under the Stealth and Privilege Escalation tactics.
How attackers use it
TLS callbacks are normally used by the operating system to set up or clean up data used by threads. They live in pointers inside a portable executable (PE) file. In TLS callback injection, an adversary manipulates those pointers so the process reaches malicious code before it gets to its legitimate entry point.
MITRE notes that the manipulation is usually done by allocating and writing to specific offsets in the process's memory, using other injection techniques such as process hollowing. So this technique often appears as the second half of a chain.
Running inside another process can give access to its memory, system and network resources, and possibly elevated privileges. It can also hide the activity under a legitimate process name.
How to detect it
MITRE's detection strategy watches for memory modifications to PE headers and the TLS directory structures during or after hollowing events. It then looks for odd thread behavior before the main entry point executes.
Two practical signals follow from that. First, a process whose headers change after launch. Second, thread activity that starts before a program's normal entry point and does not match the program.
How to reduce the risk
The one mitigation listed is Behavior Prevention on Endpoint. Some endpoint security products can block common behavior sequences seen during injection. Confirm yours is enabled in blocking mode on Windows hosts.
Quick check
When does TLS callback code run relative to the program's entry point?
Before it. That is what makes the technique useful to an adversary and what the detection strategy looks for.
