Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detector Tags	Injection Analytics
ATT&CK Tactic	Stealth (TA0005), Privilege Escalation (TA0004)
ATT&CK Technique	Process Injection: Portable Executable Injection (T1055.002)
Severity	Low

Description

A process wrote a PE header to another process by calling the NtWriteVirtualMemoryRemote API function.

Attacker's Goals

Gain code execution on the host in the context of another process.

Investigative actions

• Investigate the acting process for other malicious activities.
• Check if the target process was injected and for anomalies in its behavior after this event.

Variations

Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer from an office process

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005), Privilege Escalation (TA0004)
ATT&CK Technique	Process Injection: Portable Executable Injection (T1055.002)
Severity	High

Description

An office process wrote a PE header to another process by calling the NtWriteVirtualMemoryRemote API function.

Attacker's Goals

Gain code execution on the host in the context of another process.

Investigative actions

• Investigate the acting process for other malicious activities.
• Check if the target process was injected and for anomalies in its behavior after this event.

Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer from an injected thread

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005), Privilege Escalation (TA0004)
ATT&CK Technique	Process Injection: Portable Executable Injection (T1055.002)
Severity	Medium

Description

An injected thread wrote a PE header to another process by calling the NtWriteVirtualMemoryRemote API function.

Attacker's Goals

Gain code execution on the host in the context of another process.

Investigative actions

• Investigate the acting process for other malicious activities.
• Check if the target process was injected and for anomalies in its behavior after this event.

Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer from a LOLBIN process

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005), Privilege Escalation (TA0004)
ATT&CK Technique	Process Injection: Portable Executable Injection (T1055.002)
Severity	Medium

Description

A LOLBIN process wrote a PE header to another process by calling the NtWriteVirtualMemoryRemote API function.

Attacker's Goals

Gain code execution on the host in the context of another process.

Investigative actions

• Investigate the acting process for other malicious activities.
• Check if the target process was injected and for anomalies in its behavior after this event.

Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer from an unsigned process

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005), Privilege Escalation (TA0004)
ATT&CK Technique	Process Injection: Portable Executable Injection (T1055.002)
Severity	Medium

Description

An unsigned process wrote a PE header to another process by calling the NtWriteVirtualMemoryRemote API function.

Attacker's Goals

Gain code execution on the host in the context of another process.

Investigative actions

• Investigate the acting process for other malicious activities.
• Check if the target process was injected and for anomalies in its behavior after this event.