Process Modification (d5fca4e4-e47a-487b-873f-3d22f8865e96)
Changes made to a running process, such as writing data into memory, modifying execution behavior, or injecting code into an existing process. Adversaries frequently modify processes to execute malicious payloads, evade detection, or gain escalated privileges.
Data Collection Measures:
- Endpoint Detection and Response (EDR) Tools:
- EDRs can monitor memory modifications and API-level calls.
- Sysmon (Windows):
- Event ID 8 (CreateRemoteThread) – Detects cross-process thread injection, commonly used in process hollowing.
- Event ID 10 (Process Access) – Detects access attempts to another process, often preceding injection attempts.
- Linux/macOS Monitoring:
- AuditD (ptrace, mmap, mprotect syscalls): Detects memory modifications and debugging attempts.
- eBPF/XDP: Monitors low-level system calls related to process modifications.
- OSQuery: The processes table can be queried for unusual modifications.
- Network-Based Monitoring:
- Zeek (Bro) Logs: Captures lateral movement attempts where adversaries remotely modify a process.
- Syslog/OSSEC: Monitors logs for suspicious modifications.