diff --git a/Windows/Privilege_Escalation/Process_Injection.md b/Windows/Privilege_Escalation/Process_Injection.md deleted file mode 100644 index 723ca961..00000000 --- a/Windows/Privilege_Escalation/Process_Injection.md +++ /dev/null @@ -1,17 +0,0 @@ -## Process Injection - -MITRE ATT&CK Technique: [T1055](https://attack.mitre.org/wiki/Technique/T1055) - -Examples and code resource for [PowerSploit](https://github.com/PowerShellMafia/PowerSploit/tree/master/CodeExecution) - -### PowerShell Invoke-ReflectivePEInjection - -Input: - - C:\Users\Public\PowerSploit-master\PowerSploit-master\CodeExecution\Invoke-ReflectivePEInjection.ps1 - -### Powershell Invoke-DllInjection - -Input: - - C:\Users\Public\PowerSploit-master\PowerSploit-master\CodeExecution\Invoke-DllInjection.ps1 -ProcessID 4274 -Dll evil.dll diff --git a/atomics/T1055/T1055.yaml b/atomics/T1055/T1055.yaml new file mode 100644 index 00000000..30b97730 --- /dev/null +++ b/atomics/T1055/T1055.yaml @@ -0,0 +1,45 @@ +--- +attack_technique: T1055 +display_name: Process Injection + +atomic_tests: +- name: Process Injection via mavinject.exe + description: | + Windows 10 Utility To Inject DLLS + + supported_platforms: + - windows + + input_arguments: + dll_payload: + description: DLL to Inject + type: Path + default: T1055.dll + process_id: + description: PID of input_arguments + type: Int + default: $pid + executor: + name: powershell + command: | + mavinject $pid /INJECTRUNNING #{dll_payload} +- name: Process Injection via PowerSploit + description: | + PowerShell Injection + + supported_platforms: + - windows + + input_arguments: + dll_payload: + description: DLL to Inject + type: Path + default: T1055.dll + process_id: + description: PID of input_arguments + type: Int + default: $pid + executor: + name: powershell + command: | + Invoke-DllInjection.ps1 -ProcessID #{process_id} -Dll #{dll_payload} diff --git a/atomics/T1055/src/Win32/T1055.dll b/atomics/T1055/src/Win32/T1055.dll new file mode 100644 index 00000000..660242c1 Binary files /dev/null and b/atomics/T1055/src/Win32/T1055.dll differ diff --git a/atomics/T1055/src/x64/T1055.dll b/atomics/T1055/src/x64/T1055.dll new file mode 100644 index 00000000..91bffa6a Binary files /dev/null and b/atomics/T1055/src/x64/T1055.dll differ