title: Shellcode Injection
id: 250ae82f-736e-4844-a68b-0b5e8cc887da
status: experimental
description: Detects shellcode injection by Metasploit's migrate and Empire's psinject
author: Bhabesh Raj
date: 2022/03/11
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1055
logsource:
    category: process_access
    product: windows
detection:
    selection:
        GrantedAccess: 
            - '0x147a'
            - '0x1f3fff'
        CallTrace|contains: 'UNKNOWN'
    condition: selection
falsepositives:
    - Empire's csharp_exe payload uses 0x1f3fff for process enumeration as well
level: high