TA0004 · PRIVILEGE ESCALATION
Dynamic-link Library Injection
Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
Detect it with
Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions…
Why it matters on shift
Dynamic-link Library Injection is one of the concrete ways adversaries achieve privilege escalation. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After privilege escalation, the next tactic is usually Defense Evasion. Search your telemetry for the transition before closing the ticket.
Kill-chain context