The adversary takes advantage of a bug in an application failing to verify the integrity of the running process to execute arbitrary code in the address space of a separate live process. The adversary could use running code in the context of another process to try to access process's memory, system/network resources, etc. The goal of this attack is to evade detection defenses and escalate privileges by masking the malicious code under an existing legitimate process. Examples of approaches include but not limited to: dynamic-link library (DLL) injection, portable executable injection, thread execution hijacking, ptrace system calls, VDSO hijacking, function hooking, reflective code loading, and more.
Description
Attack Execution Flow
3
1
Step 1
Explore[Determine target process] The adversary determines a process with sufficient privileges that they wish to include code into.
On Windows, use the process explorer's security tab to see if a process is running with administror privileges.
On Linux, use the ps command to view running processes and pipe the output to a search for a particular user, or the root user.
AI Translation
[Determina il processo target] L'attore malevolo individua un processo con privilegi sufficienti in cui desidera inserire del codice.
Su Windows, utilizza la scheda sicurezza di Process Explorer per verificare se un processo è in esecuzione con privilegi amministrativi.
Su Linux, utilizza il comando ps per visualizzare i processi in esecuzione e reindirizza l'output a una ricerca di un utente specifico o dell'utente root.
Attack Techniques
-
On Linux, use the ps command to view running processes and pipe the output to a search for a particular user, or the root user.
-
On Windows, use the process explorer's security tab to see if a process is running with administror privileges.IT: Su Linux, utilizza il comando ps per visualizzare i processi in esecuzione e reindirizza l'output a una ricerca per un utente specifico, o per l'utente root.
2
Step 2
Experiment[Attempt to include simple code with known output] The adversary attempts to include very simple code into the existing process to determine if the code inclusion worked. The code will differ based on the approach used to include code into an existing process.
AI Translation
[Tentativo di includere codice semplice con output noto] L'attore malevolo tenta di includere codice molto semplice nel processo esistente per determinare se l'inclusione del codice ha avuto successo. Il codice varierà in base all'approccio utilizzato per includere il codice in un processo esistente.
3
Step 3
Exploit[Include arbitrary code into existing process] Once an adversary has determined that including code into the existing process is possible, they will include code for a targeted purpose, such as accessing that process's memory.
AI Translation
[Includere codice arbitrario nel processo esistente] Una volta che un avversario ha determinato che è possibile includere codice nel processo esistente, inserirà codice per uno scopo mirato, come accedere alla memoria di quel processo.
Mitigations
7
Prevent Unknown Or Malicious Software From Loading Through Using An Allowlist Policy.
Properly Restrict The Location Of The Software Being Used.
Leverage Security Kernel Modules Providing Advanced Access Control And Process Restrictions Like Selinux.
Monitor Api Calls Like Createremotethread, Suspendthread/Setthreadcontext/Resumethread, Queueuserapc, And Similar For Windows.
Monitor Api Calls Like Ptrace System Call, Use Of Ld_Preload Environment Variable, Dlfcn Dynamic Linking Api Calls, And Similar For Linux.
Monitor Api Calls Like Setwindowshookex And Setwineventhook Which Install Hook Procedures For Windows.
Monitor Processes And Command-Line Arguments For Unknown Behavior Related To Code Injection.
Consequences
Security Scopes Affected
Confidentiality
Integrity
Potential Impacts
Execute Unauthorized Commands
Read Data
Relationships
Parent CAPECs
Related ATT&CK Techniques
4
T1505.005
Terminal Services DLL
Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop …
T1574.006
Dynamic Linker Hijacking
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During …
T1574.013
KernelCallbackTable
Adversaries may abuse the <code>KernelCallbackTable</code> of a process to hijack its execution flow in order to run their own payloads.(Citation: …
T1620
Reflective Code Loading
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves …