T1055.003 — Thread Execution Hijacking

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process. Thread Execution Hijacking is commonly…

Sub-technique of Process Injection (T1055).

Sigma detection rules (1)

T1055.003 Process Injection: Thread Execution Hijacking

title: "T1055.003 Process Injection: Thread Execution Hijacking"
id: 350a1345-592b-4cf0-b46c-6666cd35d247
description: 'Detects ProcessAccess events where GrantedAccess combines PROCESS_SUSPEND_RESUME with memory read/write/operation rights (e.g. 0x1838) or near-full access (0x1F0FFF-0x1F3FFF) -- the process-level handle a caller obtains before enumerating and hijacking a target thread via OpenThread/SuspendThread/SetThreadContext/ResumeThread. Note: Sysmon has no dedicated thread-handle (OpenThread) telemetry, so this is a process-level proxy, not a direct observation of thread hijacking, and overlaps with T1055.001/.004 patterns. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: TargetProcessList, TimeWindow, SuspiciousThreadContextRegions, ParentProcessAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1055/003
author: Shahrukh Khan
date: 2026-02-23
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1055.003

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '10'
    GrantedAccess:
      - '0x1F0FFF'
      - '0x1F1FFF'
      - '0x1F2FFF'
      - '0x1F3FFF'
      - '0x1838'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  filter_known_tools:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\ProcExp64.exe'
      - '\procexp.exe'
      - '\WmiPrvSE.exe'

  condition: selection and not (filter_system_account or filter_known_tools)

falsepositives:
  - Debuggers and process-suspension utilities (Process Explorer, Process Hacker) legitimately requesting suspend/resume plus memory-access rights (excluded via filter_known_tools); System and service accounts are excluded via filter_system_account; this GrantedAccess pattern is shared with T1055.001/.004 since Sysmon cannot distinguish thread-handle-level intent -- corroborate with EDR thread telemetry where available.

level: medium

Related sub-techniques

Explore