T1055.004 — Asynchronous Procedure Call

T1055.004 Process Injection: Asynchronous Procedure Call

title: "T1055.004 Process Injection: Asynchronous Procedure Call"
id: f5caa299-f1bd-4578-876c-95663617a84b
description: 'Detects ProcessAccess events where GrantedAccess grants memory read/write/operation rights (e.g. 0x1038, 0x103A) or near-full access (0x1F0FFF-0x1F3FFF) -- the process-level handle a caller must obtain before opening a target thread and queuing an APC via QueueUserAPC/NtQueueApcThread. Note: Sysmon has no dedicated thread-handle (OpenThread) or APC-queuing telemetry, so this rule observes the memory-access precursor rather than the APC queuing itself and should be treated as a lower-fidelity proxy pending EDR-grade telemetry. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: APCTargetProcessList, ThreadQueueDepthThreshold, TimeWindow, UserContextSensitivity.'
references:
  - https://attack.mitre.org/techniques/T1055/004
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1055.004

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '10'
    GrantedAccess:
      - '0x1F0FFF'
      - '0x1F1FFF'
      - '0x1F2FFF'
      - '0x1F3FFF'
      - '0x1038'
      - '0x103A'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  filter_known_tools:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\ProcExp64.exe'
      - '\procexp.exe'
      - '\WmiPrvSE.exe'

  condition: selection and not (filter_system_account or filter_known_tools)

falsepositives:
  - This GrantedAccess pattern is shared with T1055.001/.003 since Sysmon ProcessAccess cannot distinguish thread-handle intent; AV/EDR/Sysinternals tooling excluded via filter_known_tools; System and service accounts excluded via filter_system_account.

level: medium