{
  "family": "dllinject",
  "sample_count": 97,
  "category": "ransomware",
  "description": "Behavior:Win32/Dllinject is a critical heuristic detection for malware or attack frameworks that actively exploit 'DLL Injection' techniques to force a legitimate, running process to load and execute a malicious Dynamic-Link Library (DLL), bypassing endpoint firewalls and masking malicious activity.<br><br><b>Understanding DLL Injection</b><br>For the end-user, this behavior is invisible. For an incident responder, a Dllinject alert is a high-severity warning indicating advanced threat activity. Legitimate software uses DLLs to share code. Malware uses DLL injection to hide its code. By injecting a malicious DLL into a trusted process (like `explorer.exe` or `svchost.exe`), the malware's network traffic and file system access appear to originate from the trusted Windows component, effortlessly bypassing legacy security tools and application whitelisting.<br><br><b>Execution and Evasion Strategies</b><br>This technique is a staple of advanced malware, including ransomware, banking trojans, and APT tools (like Cobalt Strike). The attacker drops a malicious DLL to disk (or decrypts it in memory). A loader executable then utilizes Windows APIs (such as `OpenProcess`, `VirtualAllocEx` to allocate memory in the target process, `WriteProcessMemory` to write the path of the malicious DLL, and `CreateRemoteThread` to force the target process to call `LoadLibrary` on that path). The target process unwittingly loads the malware into its own memory space and executes it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the injected payload, but the presence of this technique guarantees a sophisticated attacker. Incident responders must perform live memory forensics. EDR platforms detect this by monitoring for the specific sequence of cross-process API calls (`CreateRemoteThread`) or by detecting known malicious DLLs being loaded by unexpected processes (e.g., `notepad.exe` loading a DLL that immediately opens a network socket).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1574.002",
    "T1055",
    "T1055.012",
    "T1106",
    "T1055.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    },
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading",
      "tactic": "Persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; process injection is the hallmark of active, severe threats like ransomware precursors or interactive APT access.",
    "Do NOT reboot the machine. Capture a full forensic memory image (RAM dump) immediately to preserve the injected, memory-resident DLL.",
    "Utilize EDR to analyze the threads running within the targeted process (e.g., explorer.exe) to identify the specific injected module.",
    "Assume the endpoint is severely compromised and perform a full OS rebuild after forensic evidence has been secured."
  ],
  "what_to_avoid": [
    "Do not arbitrarily kill the target process without capturing memory first; killing a critical process like `csrss.exe` will crash the system (BSOD) and destroy evidence.",
    "Avoid relying on static disk scans to remediate the threat; the malicious activity is occurring entirely within the memory space of a legitimate process."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}