Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1055

Process Injection

StealthPrivilege Escalation 98 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
splunk Cisco Secure Firewall - Communication Over Suspicious Ports production 2026-10-08
splunk Cisco NVM - Non-Network Binary Making Network Connection production 2026-09-22
splunk Cisco NVM - Suspicious Network Connection From Process With No Args production 2026-09-22
splunk Windows PUA Named Pipe production 2026-09-22
splunk Windows Suspicious Named Pipe production 2026-09-22
splunk Windows Suspicious C2 Named Pipe production 2026-09-22
splunk Windows RMM Named Pipe production 2026-09-22
elastic Memory Threat - Detected - Elastic Defend production 2026-09-18
elastic Suspicious Process Creation CallTrace production 2026-09-18
elastic Suspicious Process Access via Direct System Call production 2026-09-18
elastic Suspicious Managed Code Hosting Process production 2026-09-18
elastic Potential Process Injection via PowerShell production 2026-09-18
elastic Suspicious .NET Reflection via PowerShell production 2026-09-18
elastic Suspicious Endpoint Security Parent Process production 2026-09-18
elastic Process Injection by the Microsoft Build Engine production 2026-09-18
elastic Suspicious Communication App Child Process production 2026-09-18
elastic Process Injection - Prevented - Elastic Endgame production 2026-09-18
elastic Process Injection - Detected - Elastic Endgame production 2026-09-18
elastic Unusual Windows Network Activity production 2026-09-18
elastic Unusual Linux Network Activity production 2026-09-18
elastic Potential Sudo Token Manipulation via Process Injection production 2026-09-18
elastic Root Network Connection via GDB CAP_SYS_PTRACE production 2026-09-18
elastic Privilege Escalation via GDB CAP_SYS_PTRACE production 2026-09-18
elastic Linux Process Hooking via GDB production 2026-09-18
elastic Memory Threat - Prevented- Elastic Defend production 2026-09-18
elastic Unusual Service Host Child Process - Childless Service production 2026-09-18
elastic Unusual Parent-Child Relationship production 2026-09-18
elastic Conhost Spawned By Suspicious Parent Process production 2026-09-18
elastic Suspicious Portable Executable Encoded in Powershell Script production 2026-09-18
elastic Potential PowerShell HackTool Script by Function Names production 2026-09-18
elastic Unusual Child Process from a System Virtual Process production 2026-09-18
elastic Suspicious Zoom Child Process production 2026-09-18
sigma Potential Shellcode Injection test 2026-09-15
elastic Potential Fileless Execution via Unusual memfd Create Call production 2026-09-08
splunk Windows Process Injection Wermgr Child Process production 2026-08-18
sigma Suspicious Cross-User Process Spawn experimental 2026-07-23
splunk Wscript Or Cscript Suspicious Child Process production 2026-07-20
splunk Windows Process With NamedPipe CommandLine production 2026-07-08
splunk AWS Bedrock Claude Unusually Large Prompts production 2026-07-08
splunk AWS Bedrock Claude Sensitive Data in Prompts production 2026-07-06
splunk AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation production 2026-07-06
splunk AWS Bedrock Claude excessive use of tokens production 2026-07-06
splunk AWS Bedrock Claude Hostile Prompt Sentiment production 2026-07-06
splunk AWS Bedrock Claude Possible Prompt Injection production 2026-07-06
sigma Execution Of Non-Existing File test 2026-07-05
splunk Powershell Remote Thread To Known Windows Process production 2026-07-01
splunk Create Remote Thread In Shell Application production 2026-06-29
splunk Rundll32 Create Remote Thread To A Process production 2026-06-29
sigma CobaltStrike Named Pipe Pattern Regex test 2026-06-18
splunk Notepad with no Command Line Arguments production 2026-05-13
splunk DLLHost with no Command Line Arguments with Network production 2026-05-13
splunk GPUpdate with no Command Line Arguments with Network production 2026-05-13
splunk Powershell Fileless Process Injection via GetProcAddress production 2026-05-13
splunk SearchProtocolHost with no Command Line with Network production 2026-05-13
splunk Suspicious DLLHost no Command Line Arguments production 2026-05-13
splunk Suspicious GPUpdate no Command Line Arguments production 2026-05-13
splunk Suspicious SearchProtocolHost no Command Line Arguments production 2026-05-13
splunk Trickbot Named Pipe production 2026-05-13
splunk Windows List ENV Variables Via SET Command From Uncommon Parent production 2026-05-13
splunk Windows Process Injection In Non-Service SearchIndexer production 2026-05-13
splunk Windows Remote Assistance Spawning Process production 2026-05-13
splunk Winhlp32 Spawning a Process production 2026-05-13
sigma RedSun - TieringEngineService.exe Detected as EICAR Test File experimental 2026-04-17
sigma RedSun - Named Pipe Created experimental 2026-04-17
sigma Uncommon Svchost Command Line Parameter experimental 2026-03-23
elastic Deprecated - Network Connection via Sudo Binary deprecated 2026-02-04
sigma Rare Remote Thread Creation By Uncommon Source Image test 2025-12-08
sigma Suspicious Userinit Child Process test 2025-10-17
sigma Potential Executable Run Itself As Sacrificial Process experimental 2025-10-17
sigma Process Creation Using Sysnative Folder test 2025-10-08
sigma Remote Thread Creation By Uncommon Source Image test 2025-07-08
sigma Remote Thread Created In Shell Application test 2025-07-04
sigma Lummac Stealer Activity - Execution Of More.com And Vbc.exe experimental 2024-12-19
sigma HackTool - CoercedPotato Execution test 2024-11-23
sigma Suspicious Child Process Of Wermgr.EXE test 2024-08-29
sigma Microsoft Sync Center Suspicious Network Connections test 2024-03-12
sigma Network Connection Initiated Via Notepad.EXE test 2024-02-02
sigma CobaltStrike Named Pipe Patterns test 2024-01-26
sigma PowerShell ShellCode test 2024-01-25
sigma HackTool - EfsPotato Named Pipe Creation test 2023-12-21
sigma Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection stable 2023-10-23
sigma HackTool - CoercedPotato Named Pipe Creation test 2023-10-11
sigma Injected Browser Process Spawning Rundll32 - GuLoader Activity test 2023-08-07
sigma Malicious Named Pipe Created test 2023-08-07
sigma Dllhost.EXE Execution Anomaly test 2023-05-15
sigma DotNet CLR DLL Loaded By Scripting Applications test 2023-02-23
sigma HackTool - DInjector PowerShell Cradle Execution test 2023-02-04
sigma Potential Process Injection Via Msra.EXE test 2023-02-03
sigma Potential Dridex Activity stable 2023-02-03
sigma Potential DLL Sideloading Using Coregen.exe test 2022-12-31
sigma CobaltStrike Named Pipe test 2022-10-31
sigma APT PRIVATELOG Image Load Pattern test 2022-10-09
sigma Suspicious Rundll32 Invoking Inline VBScript test 2022-10-09
elastic Suspicious Process from Conhost deprecated 2022-08-03
sigma Suspect Svchost Activity test 2022-06-27
sigma Created Files by Microsoft Sync Center test 2022-06-02
sigma Malware Shellcode in Verclsid Target Process test 2021-11-27
sentinel Solorigate Named Pipe Scheduled —