ATT&CK technique · T1055
Process Injection
Privilege EscalationStealth· seen in 19 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-1193 KEV CVEsImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1203 KEV CVEsBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1213 KEV CVEsStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1223 KEV CVEsHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-893 KEV CVEsImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Input is concatenated into a database query, letting attackers read or change data they shouldn't.
- CWE-13362 KEV CVEsImproper Neutralization of Special Elements Used in a Template EngineInput is rendered as a template, so template syntax in it runs on the server.
- CWE-772 KEV CVEsImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-782 KEV CVEsImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
Controls that mitigate it (12)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CM · Configuration Management
IA · Identification and Authentication
SC · System and Communications Protection
SI · System and Information Integrity
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.