T1055.002 — Portable Executable Injection

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process. PE injection is commonly performed by copying code…

Sub-technique of Process Injection (T1055).

Sigma detection rules (1)

T1055.002 Process Injection: Portable Executable Injection

title: "T1055.002 Process Injection: Portable Executable Injection"
id: df1ed57a-b079-462d-96f4-7d583ac55da6
description: 'Behavioral Detection of PE Injection via Remote Memory Mapping. (Retargeted from the original process_creation label to process_access — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: PayloadEntropyThreshold, TargetProcessList, TimeWindow, ParentProcessAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1055/002
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1055.002

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    TargetImage|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
      - '\winlogon.exe'
    GrantedAccess:
      - '0x1F0FFF'
      - '0x1F1FFF'
      - '0x1FFFFF'

  filter_avedr:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\CSFalconService.exe'

  condition: selection and not filter_avedr

falsepositives:
  - Legitimate AV/EDR agents opening high-privilege handles to system processes for scanning purposes; the filter excludes the most common ones, but validate SourceImage against your specific security stack.

level: critical

Related sub-techniques

Explore