T1055.015 — ListPlanting

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via…

Sub-technique of Process Injection (T1055).

Sigma detection rules (1)

T1055.015 Process Injection: ListPlanting

title: "T1055.015 Process Injection: ListPlanting"
id: fbb43c2f-89fb-47ae-9921-ef0c99277e94
description: 'Detection Strategy for ListPlanting Injection on Windows. (Retargeted from the original process_creation label to process_access — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TimeWindow_PostMessage_to_LVM_SORTITEMS, TargetWindowClassName, UserContextAnomalyThreshold, InterprocessWindowMessagingFrequency.'
references:
  - https://attack.mitre.org/techniques/T1055/015
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1055.015

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    TargetImage|endswith: '\explorer.exe'
    GrantedAccess: '0x1F3FFF'
    CallTrace|contains: 'UNKNOWN'

  filter_known_tools:
    SourceImage|endswith:
      - '\WerFault.exe'
      - '\procexp.exe'
      - '\procexp64.exe'
      - '\ProcessHacker.exe'

  condition: selection and not filter_known_tools

falsepositives:
  - ListPlanting relies on SysListView32 window-message telemetry that Sysmon ProcessAccess events do not capture; treat this as a low-confidence proxy pending EDR window-message monitoring.

level: low

Related sub-techniques

Explore