T1659 — Content Injection

Tactics: Initial Access, Command and Control · Platforms: Linux, macOS, Windows

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries…

Sigma detection rules (3)

T1659 Content Injection

title: T1659 Content Injection
id: c4118716-e98c-45b1-9ced-bab426d07490
description: 'Detection Strategy for Content Injection (T1659): flags processes programmatically modifying the Windows Internet Settings proxy configuration (ProxyServer/ProxyEnable/AutoConfigURL) -- the on-host indicator of an adversary redirecting a victim''s network traffic through an attacker-controlled relay to inject or manipulate content in transit. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: MonitoredExtensions, SuspiciousParentProcesses, RedirectList.'
references:
  - https://attack.mitre.org/techniques/T1659
author: Shahrukh Khan
date: 2026-01-15
license: MIT
tags:
  - attack.initial-access
  - attack.command-and-control
  - attack.t1659

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    EventID:
      - '12'
      - '13'
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer'
      - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable'
      - '\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate IT-managed proxy deployment (GPO, MDM profile push) changing the same keys; System and service accounts performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1659 Content Injection

title: T1659 Content Injection
id: dcf9bd8d-0c55-48fc-8810-a907beb2ffde
description: 'Content Injection describes an on-path or on-side actor (e.g. an ISP performing "lawful interception") manipulating network traffic in-flight to inject or race malicious responses to legitimate requests. This wire-level manipulation and response-racing behavior is not observable via Linux host auditd/syslog telemetry at all -- auditd has no visibility into packet content, duplicate/conflicting responses, or timing races; genuine detection requires network-tap telemetry (e.g. Zeek/Suricata) comparing responses to the same request. The previous rule (new .php/.jsp/.so/.ko files appearing under /tmp) was an unrelated webshell/backdoor-staging pattern with no relationship to network content injection. As the closest defensible Linux-observable proxy, this version narrows to a web-server worker process itself (apache2/nginx/php-fpm/httpd) writing a new executable web-script file, the typical on-host artifact left behind when injected/manipulated network content results in a dropped payload (the follow-on Ingress Tool Transfer effect this technique enables). Tune using: TempDirectories, WebServerProcessNames.'
references:
  - https://attack.mitre.org/techniques/T1659
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.initial-access
  - attack.command-and-control
  - attack.t1659

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_writer:
    type: PATH
    exe|endswith:
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/httpd'
  selection_susp_ext:
    name|endswith:
      - '.php'
      - '.jsp'
      - '.phtml'
      - '.jspx'
  selection_create:
    nametype: 'CREATE'

  condition: all of selection_*

falsepositives:
  - Legitimate web application deployments, CMS plugin/theme installation, and cache/template compilation performed by the web server process account; auditd cannot confirm the file's content arrived via manipulated network traffic versus a normal deploy.

level: medium

T1659 Content Injection

title: T1659 Content Injection
id: d1b0a8f5-3a00-44d9-8d50-024b24999ad4
description: 'Detection Strategy for Content Injection. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredDirectories.'
references:
  - https://attack.mitre.org/techniques/T1659
author: Shahrukh Khan
date: 2026-03-06
license: MIT
tags:
  - attack.initial-access
  - attack.command-and-control
  - attack.t1659

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/nc'
    CommandLine|contains: '--interface'

  condition: selection

falsepositives:
  - Content injection into legitimate unencrypted traffic streams happens on the network path and produces no distinctive local macOS process artifact, so this rule can only weakly catch tooling that binds to a specific network interface, which is also used for legitimate multi-homed testing.

level: medium

Explore