Zbulimi i Injektimit të Proceseve

Process injection is a common attacker technique: malicious code is written into the address space of a legitimate process and executed from there, making the injected code appear to originate from a trusted binary.

Techniques include DLL injection (LoadLibrary into a remote process), reflective DLL loading (bypassing Windows loader altogether), process hollowing (starting a suspended legitimate process and replacing its image), and more advanced variants like PPID spoofing and transacted hollowing. Each technique leaves subtly different artifacts in memory and in OS bookkeeping. In Volatility, the malfind plugin scans each process for memory regions that are executable and private (not backed by a file on disk) and contain code-like patterns. It catches most off-the-shelf injection payloads. More stealthy variants require additional plugins like ldrmodules (compares three different lists of loaded modules to find ones hidden from one view), handles and vadinfo for VAD tree analysis. Endpoint Detection and Response (EDR) products turn these memory-forensic techniques into real-time defenses. They hook suspicious Win32 calls (CreateRemoteThread, WriteProcessMemory, NtMapViewOfSection) and flag processes that perform them. A forensic analyst examining an infected machine should know both the attacker techniques and the tools that detect them — the two sides reinforce each other.

Mjete:

• Volatility plugins: malfind, hollowfind, ldrmodules.
• Process Hacker, Process Monitor — live analysis.
• Sysmon + ETW për detection.

Gjetja e proceseve me kod suspekt të injektuar:

vol -f mem.raw windows.malfind
vol -f mem.raw windows.hollowfind
vol -f mem.raw windows.dlllist | grep -i suspicious.dll

1. Analizo një imazh memorie me Process Hollowing (mostër nga DFIR public repos).
2. Shpjego 3 teknika injektimi: DLL injection, reflective DLL, process hollowing.

• MITRE ATT&CK — T1055 Process Injection.
• Ligh­thouse / VolatilityBot.