Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process. TLS…
Sub-technique of Process Injection (T1055).
T1055.005 Process Injection: Thread Local Storage
title: "T1055.005 Process Injection: Thread Local Storage"
id: f8e11f73-53f4-45e2-b85d-42792b4a9b61
description: 'Detects CreateRemoteThread activity targeting unbacked memory (empty StartModule), a generic process-injection indicator consistent with TLS callback abuse and process hollowing; Sysmon has no event that directly surfaces TLS callback invocation, so this is the closest defensible proxy. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: TargetProcessFilter, TimeWindowBetweenLoadAndTLSModification, AnomalousThreadStartThreshold, PayloadEntropyThreshold.'
references:
- https://attack.mitre.org/techniques/T1055/005
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
- attack.stealth
- attack.privilege-escalation
- attack.t1055.005
logsource:
category: create_remote_thread
product: windows
service: sysmon
detection:
selection:
EventID: 8
StartModule: ''
filter_system_account:
TargetUser|contains:
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
condition: selection and not filter_system_account
falsepositives:
- Legitimate applications that inject helper threads into their own child processes (some installers, debuggers, and security products) can trigger CreateRemoteThread into unbacked memory; system/service accounts are excluded via filter_system_account, tune further with process allowlists if noise remains.
level: medium