ListPlanting is MITRE ATT&CK T1055.015, a Windows sub-technique of Process Injection under Stealth and Privilege Escalation. Code run this way is masked under a legitimate process.
How attackers use it
List-view controls are interface windows that display collections of items. Their settings live in the process's memory in a SysListView32 control. MITRE calls ListPlanting a form of message-passing "shatter attack". Code is copied into the address space of a process that has a list-view control and is then used as a custom callback for sorting the listed items.
Getting the code there can use other injection methods, or a handle to the SysListView32 child window found with calls like FindWindow or EnumWindows. Some variations allocate memory in the target and then copy the payload using window messages, avoiding the heavily monitored WriteProcessMemory. MITRE's example is sending LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages with PostMessage or SendMessage, which copies a payload two bytes at a time. The payload is triggered by a final sort message.
How to detect it
MITRE's detection strategy looks for this sequence:
- Window discovery (FindWindow, EnumWindows or EnumChildWindows).
- Memory allocation in another process (VirtualAllocEx or similar).
- Unusual PostMessage or SendMessage traffic to SysListView32 controls, such as LVM_SETITEMPOSITION.
- An LVM_SORTITEMS invocation, in place of WriteProcessMemory.
The key point is that the missing WriteProcessMemory is part of the pattern. Detections built only around that call will not see it.
How to reduce the risk
MITRE lists Behavior Prevention on Endpoint. Some endpoint security tools block injection based on common behavior sequences. Ask your vendor whether message-based injection is covered, and run it in blocking mode.
Check your own environment
- Verify your telemetry captures window message APIs sent across process boundaries, not only memory write calls.
- Test detections with a benign simulation approved by your security team.
Quick check
Why do some ListPlanting variants avoid WriteProcessMemory?
They copy the payload with window messages instead, two bytes at a time, to avoid a function that is highly monitored.
