Remote-write process handle opened from an unbacked call stack

Siemphony@siemphonymediumT1055.002verified in lab

AN0297 describes a four-step chain — OpenProcess, VirtualAllocEx, WriteProcessMemory of an MZ header or shellcode, then CreateRemoteThread — and Process Access is the one log source in the strategy where the access rights that chain requires and the identity of the caller arrive together on a single event. The rule therefore matches the OpenProcess step and requires two things at once: a GrantedAccess mask that grants remote memory write, memory operation and remote thread creation (the full-access variants plus the narrower query/write/create-thread masks a minimal injector asks for), and a CallTrace containing an UNKNOWN frame, which is how Sysmon renders a return address that no loaded module backs. That second half is the closest single-event proxy for the analytic's "without touching disk" — code executing from allocated memory rather than from a mapped image. The mask list is assembled here and is not MITRE's; this brief's knobs are PayloadEntropyThreshold, TargetProcessList, TimeWindow and ParentProcessAnomalyThreshold, and of those only TargetProcessList is expressible, as an added TargetImage filter once a site knows which processes should never be opened this way. Two limits are structural: an injector whose code runs from a normal on-disk DLL produces a fully module-backed CallTrace and is missed entirely, and the allocation, the write and the thread creation are separate events that lib/sigma has no timeframe or correlation to join, so only the handle acquisition is modelled. Nothing in the logic is specific to a portable executable either: the MZ header that separates this sub-technique from DLL injection, section mapping or hollowing sits in the WriteProcessMemory payload, which no log source in this brief records, so a hit is evidence of remote injection in general and not of PE injection in particular. Prerequisite: Sysmon emits EventID 10 only where the configuration carries a ProcessAccess rule, and the widely used baseline configurations scope that to lsass.exe alone — on such a host this rule returns zero rows, and zero rows reads as quiet when it actually means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0106, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((GrantedAccess="0x1F0FFF" OR GrantedAccess="0x1F1FFF" OR GrantedAccess="0x1F2FFF" OR GrantedAccess="0x1F3FFF" OR GrantedAccess="0x1FFFFF" OR GrantedAccess="0x147A" OR GrantedAccess="0x143A" OR GrantedAccess="0x47A" OR GrantedAccess="0x43A" OR GrantedAccess="0x42A" OR GrantedAccess="0x2A") AND CallTrace="*UNKNOWN*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(GrantedAccess) == "0x1f0fff" OR TO_LOWER(GrantedAccess) == "0x1f1fff" OR TO_LOWER(GrantedAccess) == "0x1f2fff" OR TO_LOWER(GrantedAccess) == "0x1f3fff" OR TO_LOWER(GrantedAccess) == "0x1fffff" OR TO_LOWER(GrantedAccess) == "0x147a" OR TO_LOWER(GrantedAccess) == "0x143a" OR TO_LOWER(GrantedAccess) == "0x47a" OR TO_LOWER(GrantedAccess) == "0x43a" OR TO_LOWER(GrantedAccess) == "0x42a" OR TO_LOWER(GrantedAccess) == "0x2a") AND TO_LOWER(CallTrace) LIKE "*unknown*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_access,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="GrantedAccess" type="pcre2">(?i)(^0x1F0FFF$|^0x1F1FFF$|^0x1F2FFF$|^0x1F3FFF$|^0x1FFFFF$|^0x147A$|^0x143A$|^0x47A$|^0x43A$|^0x42A$|^0x2A$)</field>    <field name="CallTrace" type="pcre2">(?i)UNKNOWN</field>    <description>Remote-write process handle opened from an unbacked call stack</description>    <mitre>      <id>T1055.002</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"process_access","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_access / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 2090f327-16e6-4383-8de1-36cf389116b9

ATT&CKT1055.002

T1055.002Portable Executable Injection

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

One Windows event: a process opening a handle to another process with rights that permit remote memory writing and thread creation, where the caller's stack contains a frame no loaded module backs. MITRE's AN0297 describes a four-step chain — OpenProcess, VirtualAllocEx, WriteProcessMemory of an MZ header or shellcode, CreateRemoteThread. The Sigma dialect here has no timeframe and no correlation, so only step one is modelled. Understand what that costs: a hit is evidence of remote injection in general, not of portable executable injection. The MZ header that separates this sub-technique from DLL injection or hollowing sits in the WriteProcessMemory payload, and no log source in this brief records payload bytes.

02 · Telemetry you need

Sysmon EventID 10, Process Access — category: process_access, product: windows, taken verbatim from the brief. The prerequisite is the whole ball game. Sysmon emits EID 10 only where the configuration carries a ProcessAccess rule, and the widely deployed baseline configurations scope that to lsass.exe alone. On such a host this rule returns zero rows, and zero rows reads as quiet when it actually means blind. You need GrantedAccess and CallTrace present and populated across more than one target process before the rule can say anything.

03 · How the logic works

Two selections must both be true. selection_rights matches GrantedAccess against an exact list: the full-access variants (0x1F0FFF through 0x1FFFFF) and the narrower masks a minimal injector asks for (0x147A, 0x143A, 0x47A, 0x43A, 0x42A, 0x2A) — combinations granting VM_OPERATION, VM_WRITE and CREATE_THREAD. That mask list is assembled by this pipeline; MITRE supplied none. The brief's knobs are PayloadEntropyThreshold, TargetProcessList, TimeWindow and ParentProcessAnomalyThreshold. selection_unbacked requires CallTrace|contains: 'UNKNOWN', which is how Sysmon renders a return address that no mapped image backs. That is the closest single-event proxy for the analytic's "without touching disk" — the caller is running from allocated memory. It also draws the rule's biggest blind spot: an injector whose code runs from an ordinary on-disk DLL produces a fully module-backed stack and is missed entirely.

04 · Common false positives

Managed .NET code is the dominant source and the reason the rule is medium rather than high. JIT-compiled code lives in allocated memory, so its frames render as UNKNOWN by construction — PowerShell, MSBuild, Visual Studio and every .NET line-of-business agent satisfy half the rule for free. Next come EDR, DLP and anti-cheat agents, which open full-access handles estate-wide and inject from hook trampolines in allocated memory. Then debuggers and crash handlers: WerFault.exe taking a dump, or any WinDbg attach, requests the same masks.

05 · Detection maturity

tier_1: Lowest tier. This rule was derived from prose and has never been run against a log line, so its false-positive ordering is reasoning, not measurement, and its mask list is untested against your Sysmon build. Run it in a non-alerting mode, count matches by SourceImage for a week, and only then decide the level.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Start with SourceImage. Your EDR, DLP and management agents are a small and stable set per estate; excluding them by full path removes most volume without touching adversary behaviour. Next, the only MITRE knob this shape can express is TargetProcessList — add a TargetImage filter once you know which processes should never be opened this way, and consider inverting the rule to alert only on those. PayloadEntropyThreshold and TimeWindow need a correlation engine outside Sigma. Resist trimming the mask list before you have measured it.

Declared by the author

Managed .NET applications, which are the dominant source and the reason this rule is not rated higher. JIT-compiled code is emitted into allocated memory that no module backs, so Sysmon renders those frames as UNKNOWN — any .NET process that opens a handle with these rights matches the CallTrace half by construction, including PowerShell, MSBuild, Visual Studio and the large population of management and line-of-business agents written on .NET.
Endpoint protection, EDR and DLP agents, which open full-access handles across the estate and inject their monitoring stubs from hook trampolines that live in allocated memory and so also render as UNKNOWN frames. These come from a small and stable set of SourceImage values per estate, which is where the exclusion belongs.
Debuggers and crash handlers. WerFault.exe collecting a dump, and any interactive attach from WinDbg or Visual Studio, request full access and create remote threads as their normal operation.
Anti-cheat engines, DRM wrappers and application-compatibility shims, all of which inject into their protected target by design and present the same masks.
Accessibility software, screen recorders, input-method editors and .NET profiling or APM agents that hook a running application in memory to observe or extend it.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — PE injection via CreateRemoteThread (PurpleSharp)
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1055.002, evaluated against their process_access events.

Share this rule

/u/siemphony/2090f327-16e6-4383-8de1-36cf389116b9

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Remote-write process handle opened from an unbacked call stack

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it