ATT&CK technique
View on MITRE ATT&CK →
T1055.001
Dynamic-link Library Injection
StealthPrivilege Escalation
14 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Process Injection via PowerShell | production | 2026-09-18 |
| elastic | Suspicious .NET Reflection via PowerShell | production | 2026-09-18 |
| splunk | Windows Uncommon Remote Thread Creation In Browser Process | production | 2026-06-29 |
| splunk | PowerShell PInvoke Process Injection API Chain | production | 2026-06-25 |
| splunk | Loading Of Dynwrapx Module | production | 2026-05-13 |
| splunk | Windows Rasautou DLL Execution | production | 2026-05-13 |
| sigma | ManageEngine Endpoint Central Dctask64.EXE Potential Abuse | test | 2025-01-22 |
| sigma | Renamed ZOHO Dctask64 Execution | test | 2025-01-22 |
| sigma | CreateRemoteThread API and LoadLibrary | test | 2024-01-22 |
| sigma | HackTool - Potential CobaltStrike Process Injection | test | 2023-05-05 |
| sigma | Renamed Mavinject.EXE Execution | test | 2023-02-03 |
| sigma | Potential DLL Injection Or Execution Using Tracker.exe | test | 2023-01-09 |
| sigma | Mavinject Inject DLL Into Running Process | test | 2022-12-05 |
| sigma | TAIDOOR RAT DLL Load | test | 2021-11-27 |