hunting-process-injection-with-sysmon

The full skill.

Original instructions from the publisher’s SKILL.md

# Hunting Process Injection with Sysmon

## When to Use

- You have Sysmon (or equivalent EDR) telemetry and want to hunt code injection across hosts.
- You are testing a hypothesis that an implant injects into benign processes
  (`explorer.exe`, `svchost.exe`) to evade defenses.
- You need to triage EID 8/10 events into a prioritized list of injection candidates.

**Do not use** EID 8/10 in isolation as a verdict — legitimate software (security tools,
debuggers, injectors in dev tools) generates these; correlation and baselining are required.

## Prerequisites

- Sysmon configured to log Event ID 8 (CreateRemoteThread) and 10 (ProcessAccess) with useful
  access masks; a SIEM or log export to query.
- A baseline of normal cross-process access for your environment.

## Workflow

### Step 1: Pull the candidate events

Collect EID 8 (remote thread creation) and EID 10 (process access) with high-power access
masks (e.g., `0x1F0FFF`, `PROCESS_VM_WRITE | PROCESS_CREATE_THREAD`).

### Step 2: Filter known-good

Remove baseline noise: security agents, legitimate debuggers, and known injector pairs. Keep
unusual source→target pairs (e.g., a document app injecting into a browser).

```bash
python scripts/analyst.py triage sysmon.json
```

### Step 3: Correlate signals

Raise priority when multiple indicators stack: cross-process write + remote thread into the
same target, target with RWX private memory, or source process spawned from a macro/script.

### Step 4: Pivot per candidate

For top candidates, pull the source process tree, image path, signing status, and network
connections to confirm or clear.

### Step 5: Confirm and respond

Validate suspected hollowing/shellcode (memory analysis), then escalate confirmed injections
to IR and convert the logic into a detection rule.

## Validation

- Surfaced candidates show a coherent injection pattern (access + remote thread to same PID),
  not isolated single events.
- Known-good injectors are filtered, keeping the candidate list small and reviewable.
- Confirmed cases are corroborated by process lineage or memory evidence.

## Pitfalls

- Alerting on every EID 10 — the access mask matters; filter to write/inject rights.
- Ignoring source lineage; a script-spawned source is far more suspicious.
- No baseline, so security tooling buries real injection in noise.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the Sysmon triage helper.
- Sysmon docs and ATT&CK T1055 (linked in frontmatter).