About

Imported from mukul975/anthropic-cybersecurity-skills (skills/hunting-for-process-injection-techniques/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill hunting-for-process-injection-techniques. Copyright stays with the author (Apache-2.0).

Hunting for Process Injection Techniques

Name: hunting-for-process-injection-techniques
Author: mukul975

Overview

Process injection (MITRE ATT&CK T1055) allows adversaries to execute code in the address space of another process, enabling defense evasion and privilege escalation. This skill detects injection techniques via Sysmon Event ID 8 (CreateRemoteThread), Event ID 10 (ProcessAccess with suspicious access rights), and analysis of source-target process relationships to distinguish legitimate from malicious injection.

When to Use

When investigating security incidents that require hunting for process injection techniques
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Sysmon installed with Event IDs 8 and 10 enabled
Process creation logs (Sysmon Event ID 1 or Windows 4688)
Python 3.8+ with standard library
JSON-formatted Sysmon event logs

Steps

Parse Sysmon Events — Ingest Event IDs 1, 8, and 10 from JSON log files
Detect CreateRemoteThread — Flag Event ID 8 with suspicious source-target process pairs
Analyze ProcessAccess Rights — Identify Event ID 10 with dangerous access masks (PROCESS_VM_WRITE, PROCESS_CREATE_THREAD)
Build Process Relationship Graph — Map source-to-target injection relationships
Filter Known Legitimate Pairs — Exclude known benign injection patterns (AV, debuggers, system processes)
Score Injection Severity — Apply risk scoring based on source process, target process, and access rights
Generate Hunt Report — Produce structured report with MITRE sub-technique mapping

Expected Output

JSON report of detected injection events with severity scores
Process injection relationship graph
MITRE ATT&CK sub-technique mapping (T1055.001-T1055.012)
False positive exclusion recommendations

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-hunting-for-proc-5869a8/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-hunting-for-proc-5869a8.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-hunting-for-proc-5869a8",
  "kind": "skill",
  "name": "hunting-for-process-injection-techniques",
  "description": "Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process telemetry. Use when hunting for in-memory code injection or defense evasion via legitimate process abuse on Windows endpoints.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "process-injection",
      "t1055",
      "sysmon",
      "createremotethread",
      "dll-injection",
      "edr",
      "threat-hunting",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process telemetry. Use when hunting for in-memory code injection or defense evasion via legitimate process abuse on Windows endpoints."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/hunting-for-process-injection-techniques/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/hunting-for-process-injection-techniques/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/hunting-for-process-injection-techniques/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Hunting for Process Injection Techniques\n\n## Overview\n\nProcess injection (MITRE ATT&CK T1055) allows adversaries to execute code in the address space of another process, enabling defense evasion and privilege escalation. This skill detects injection techniques via Sysmon Event ID 8 (CreateRemoteThread), Event ID 10 (ProcessAccess with suspicious access rights), and analysis of source-target process relationships to distinguish legitimate from malicious injection.\n\n\n## When to Use\n\n- When investigating security incidents that require hunting for process injection techniques\n- When building de",
  "cost": {
    "context_tokens": 486
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-hunting-for-proc-5869a8/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.