Visual Examples of Code Injection, (Thu, Nov 9th)

This post was originally published on this site

Code injection techniques (T1055 from MITRE[1]) is a common technique these days. It’s a nice way for an attacker to hide malicious code into a legit process. A deviation of this technique is called “Process Hollowing”[2] where code of the legit suspended process is wiped and replaced by malicious code. Code injection is performed by calling Microsoft API calls like: VirtualAllocEx(), NtUnmapViewOfSecrio(), WriteProcessMemory(), … (they are many others available)

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.