Cross-process write and thread rights on a system process

Siemphony@siemphonymediumT1055.001verified in labPlaybook · Privilege escalation

AN1095 describes an allocate, write, then remote-thread sequence that loads a DLL into another process, and Sysmon EventID 10 is the one log source in the brief that carries the whole sequence on a single event: VirtualAllocEx needs PROCESS_VM_OPERATION, WriteProcessMemory needs PROCESS_VM_WRITE and CreateRemoteThread needs PROCESS_CREATE_THREAD, all three on the same handle, so the GrantedAccess mask on the handle acquisition already states the intent before any of the calls are made. TargetImage is pinned to MITRE's TargetProcessList knob, populated here with the shell, session and service hosts that are the usual injection destinations; the GrantedAccess list is authored, not MITRE's, and covers both PROCESS_ALL_ACCESS forms and the minimal write-plus-create-thread combinations a tool that asks only for what it needs will present. lsass.exe is deliberately absent because the same target and mask pair is already published in this corpus at T1003.001, where it means credential access rather than injection. Limits: the LoadLibrary call or reflective loader that follows is a separate event with no join available in lib/sigma, and reflective injection never touches disk so it produces no image_load record at all. Sysmon is not present in a default install, and most published Sysmon configurations restrict the ProcessAccess section to lsass and winlogon, so this rule returns nothing until the config is widened to the targets below — zero rows here means blind, not quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0389, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Cross-process write and thread rights on a system process2id: d72673ee-fcf2-4ee9-9659-61942d44f2b23status: experimental4description: |5  AN1095 describes an allocate, write, then remote-thread sequence that loads a6  DLL into another process, and Sysmon EventID 10 is the one log source in the7  brief that carries the whole sequence on a single event: VirtualAllocEx needs8  PROCESS_VM_OPERATION, WriteProcessMemory needs PROCESS_VM_WRITE and9  CreateRemoteThread needs PROCESS_CREATE_THREAD, all three on the same handle,10  so the GrantedAccess mask on the handle acquisition already states the intent11  before any of the calls are made. TargetImage is pinned to MITRE's12  TargetProcessList knob, populated here with the shell, session and service13  hosts that are the usual injection destinations; the GrantedAccess list is14  authored, not MITRE's, and covers both PROCESS_ALL_ACCESS forms and the15  minimal write-plus-create-thread combinations a tool that asks only for what16  it needs will present. lsass.exe is deliberately absent because the same17  target and mask pair is already published in this corpus at T1003.001, where18  it means credential access rather than injection. Limits: the LoadLibrary call19  or reflective loader that follows is a separate event with no join available20  in lib/sigma, and reflective injection never touches disk so it produces no21  image_load record at all. Sysmon is not present in a default install, and most22  published Sysmon configurations restrict the ProcessAccess section to lsass23  and winlogon, so this rule returns nothing until the config is widened to the24  targets below — zero rows here means blind, not quiet.25  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0389, not hand-written and not tested by its author. Any lab result is on this rule's own page.26references:27  - https://attack.mitre.org/techniques/T1055/00128  - https://attack.mitre.org/detectionstrategies/DET038929author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)30date: 2026-08-1631tags:32  - attack.defense-evasion33  - attack.privilege-escalation34  - attack.t1055.00135logsource:36  category: process_access37  product: windows38detection:39  selection:40    TargetImage|endswith:41      - '\explorer.exe'42      - '\winlogon.exe'43      - '\services.exe'44      - '\svchost.exe'45      - '\dwm.exe'46    GrantedAccess:47      - '0x1FFFFF'48      - '0x1F3FFF'49      - '0x1F2FFF'50      - '0x1F1FFF'51      - '0x1F0FFF'52      - '0x147A'53      - '0x143A'54      - '0x47A'55      - '0x43A'56      - '0x42A'57      - '0x2A'58  condition: selection59falsepositives:60  - "Endpoint protection and EDR agents, which open a full-access handle to a process in order to inject their own user-mode hooking DLL — benign DLL injection, performed on every host at every process start, and the highest-volume match this rule produces by a wide margin until a SourceImage exclusion is built for whichever agent the estate runs. This is what sets the level."61  - "Accessibility and input tooling — screen readers, IME hosts, on-screen keyboards and window managers — which install hooks by writing into explorer.exe and dwm.exe with exactly these rights."62  - "Application-compatibility shims, licence-enforcement and DRM wrappers, and remote-support or screen-sharing products that load a helper DLL into explorer.exe to extend the shell UI."63  - "Debuggers, profilers and crash-reporting agents attached to a service host by a developer or by an automated hang investigation, all of which request allocate, write and create-thread rights against the process being analysed."64level: medium

Splunk · SPL

Run this as a search.

index=* ((TargetImage="*\\explorer.exe" OR TargetImage="*\\winlogon.exe" OR TargetImage="*\\services.exe" OR TargetImage="*\\svchost.exe" OR TargetImage="*\\dwm.exe") AND (GrantedAccess="0x1FFFFF" OR GrantedAccess="0x1F3FFF" OR GrantedAccess="0x1F2FFF" OR GrantedAccess="0x1F1FFF" OR GrantedAccess="0x1F0FFF" OR GrantedAccess="0x147A" OR GrantedAccess="0x143A" OR GrantedAccess="0x47A" OR GrantedAccess="0x43A" OR GrantedAccess="0x42A" OR GrantedAccess="0x2A"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(winlog.event_data.TargetImage) LIKE "*\\\\explorer.exe" OR TO_LOWER(winlog.event_data.TargetImage) LIKE "*\\\\winlogon.exe" OR TO_LOWER(winlog.event_data.TargetImage) LIKE "*\\\\services.exe" OR TO_LOWER(winlog.event_data.TargetImage) LIKE "*\\\\svchost.exe" OR TO_LOWER(winlog.event_data.TargetImage) LIKE "*\\\\dwm.exe") AND (TO_LOWER(winlog.event_data.GrantedAccess) == "0x1fffff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1f3fff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1f2fff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1f1fff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1f0fff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x147a" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x143a" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x47a" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x43a" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x42a" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x2a"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_access,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetImage" type="pcre2">(?i)(\\explorer\.exe$|\\winlogon\.exe$|\\services\.exe$|\\svchost\.exe$|\\dwm\.exe$)</field>    <field name="GrantedAccess" type="pcre2">(?i)(^0x1FFFFF$|^0x1F3FFF$|^0x1F2FFF$|^0x1F1FFF$|^0x1F0FFF$|^0x147A$|^0x143A$|^0x47A$|^0x43A$|^0x42A$|^0x2A$)</field>    <description>Cross-process write and thread rights on a system process</description>    <mitre>      <id>T1055.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"process_access","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_access / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d72673ee-fcf2-4ee9-9659-61942d44f2b2

ATT&CKT1055.001

T1055.001Dynamic-link Library Injection

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — DLL injected with LoadLibrary and CreateRemoteThread
passed
Siemphony IR · 3 Sept 2026
8 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1055.001, evaluated against their process_access events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

SourceImage is the field to work with, and it is the field this rule does not constrain. Baseline a week of matches grouped by SourceImage, identify your security agent and your accessibility stack, and exclude those specific signed paths — not the target processes, which is where the signal lives. MITRE's InjectedDLLSignatureStatus and ParentProcessAnomalyThreshold knobs both need a second event and a join, so they belong in your platform rather than in Sigma.

Declared by the author

Endpoint protection and EDR agents, which open a full-access handle to a process in order to inject their own user-mode hooking DLL — benign DLL injection, performed on every host at every process start, and the highest-volume match this rule produces by a wide margin until a SourceImage exclusion is built for whichever agent the estate runs. This is what sets the level.
Accessibility and input tooling — screen readers, IME hosts, on-screen keyboards and window managers — which install hooks by writing into explorer.exe and dwm.exe with exactly these rights.
Application-compatibility shims, licence-enforcement and DRM wrappers, and remote-support or screen-sharing products that load a helper DLL into explorer.exe to extend the shell UI.
Debuggers, profilers and crash-reporting agents attached to a service host by a developer or by an automated hang investigation, all of which request allocate, write and create-thread rights against the process being analysed.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

One process opening a handle to a sensitive system process with the exact rights needed to allocate memory in it, write into that memory, and start a thread there. MITRE's AN1095 describes DLL injection as a correlated sequence — VirtualAllocEx, then WriteProcessMemory, then CreateRemoteThread loading a DLL. This rule catches the handle acquisition that precedes all three.

02 · Telemetry you need

logsource: category: process_access, product: windows, copied verbatim from the analytic's first log source — Sysmon EventID 10. Two prerequisites, both easy to get wrong. Sysmon is not present in a default Windows install. More subtly, most published Sysmon configurations deliberately restrict the ProcessAccess section to lsass.exe and winlogon.exe, because logging every handle open is expensive. Under such a config this rule returns nothing for explorer.exe, svchost.exe, services.exe and dwm.exe no matter how much injection happens. Widen the config to the targets below before you trust an empty result — zero rows here means blind, not quiet.

03 · How the logic works

A single selection with two conditions that must both hold. TargetImage|endswith pins the destination to explorer.exe, winlogon.exe, services.exe, svchost.exe and dwm.exe. This is MITRE's TargetProcessList knob, populated here with the shell, session and service hosts that are the usual injection destinations. MITRE names the knob and offers explorer.exe and winlogon.exe as examples; the five-entry list as written is authored. GrantedAccess matches a list of access masks. This list is not MITRE's — it is authored here, and it is the interesting part of the rule. Sysmon reports the rights actually granted on the handle, and the three injection calls each need a specific right: PROCESS_VM_OPERATION for the allocate, PROCESS_VM_WRITE for the write, PROCESS_CREATE_THREAD for the thread. All three on one handle means the intent is already stated before a single call is made. The list covers both ends of the range: 0x1FFFFF and the 0x1F*FFF forms are PROCESS_ALL_ACCESS as reported across Windows versions, while 0x147A, 0x143A, 0x47A, 0x43A, 0x42A and 0x2A are the minimal combinations a tool that asks only for what it needs will present. lsass.exe is deliberately absent from the target list. The same target-and-mask pair is already published in this corpus at T1003.001, where it means credential access rather than injection; duplicating it here would produce two alerts for one event with conflicting technique attribution. Two limits. The LoadLibrary call or reflective loader that follows is a separate event, and lib/sigma offers no join to correlate them. Reflective injection never touches disk, so it produces no image_load record at all — AN1095's other legs are simply not reachable from a single-event rule.

04 · Common false positives

Benign DLL injection is a real and common thing. Endpoint protection and EDR agents open full-access handles to inject their own user-mode hooking DLL, on every host at every process start — that is the highest-volume match by a wide margin and it is what sets the level at medium. Accessibility tooling, IME hosts and on-screen keyboards hook explorer.exe and dwm.exe with exactly these rights. Application-compatibility shims, DRM wrappers and screen-sharing products load helper DLLs into the shell. Debuggers and crash-reporting agents request the same rights against whatever they are analysing.

05 · Detection maturity

tier_1: Lowest tier. Machine-derived from ATT&CK v19.2, never executed against a log line, with an access-mask list whose coverage has never been checked against real Sysmon output. It cannot move until it is run on live data.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/d72673ee-fcf2-4ee9-9659-61942d44f2b2

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Cross-process write and thread rights on a system process

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it