T1055.011 — Extra Window Memory Injection

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. Before creating a window,…

Sub-technique of Process Injection (T1055).

Sigma detection rules (1)

T1055.011 Process Injection: Extra Window Memory Injection

title: "T1055.011 Process Injection: Extra Window Memory Injection"
id: e1ec52dd-162d-4a32-ac15-92ba39e1c332
description: 'Detection Strategy for Extra Window Memory (EWM) Injection on Windows. (Retargeted from the original process_creation label to process_access — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TargetWindowClassRegex, ExecutionTriggerWindowMessage, SharedSectionWriteThreshold, TimeWindowSetWindowLongToMessageTrigger.'
references:
  - https://attack.mitre.org/techniques/T1055/011
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1055.011

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    TargetImage|endswith: '\explorer.exe'
    GrantedAccess:
      - '0x1F0FFF'
      - '0x1FFFFF'
    CallTrace|contains: 'UNKNOWN'

  condition: selection

falsepositives:
  - EWM injection lacks direct window-message telemetry in Sysmon; this rule narrows to explorer.exe as the canonical, most-documented EWM injection target combined with an unbacked-memory call trace, but legitimate debuggers/AV can still match.

level: high

Related sub-techniques

Explore