Which technique is used to evade detection from security products by executing arbitrary code in the address space of a separate live operation?

Process injection is a defense evasion technique where an adversary executes arbitrary code within the memory address space of a separate, legitimate live process. By running malicious code under the context of a trusted process (e.g., explorer.exe or svchost.exe), the attacker can bypass security controls like firewalls and antivirus software that may be monitoring for new, suspicious processes. This method effectively hides the malicious activity, making detection significantly more challenging for endpoint security solutions.

B. privilege escalation: This is the objective of gaining higher-level permissions, not the specific technique of running code in another process's memory space as described.
C. GPO modification: This technique involves altering system settings via Active Directory Group Policy for persistence or lateral movement, not injecting code into a live process.
D. token manipulation: This involves stealing or impersonating security tokens to adopt another user's identity or privileges, which is distinct from executing new code in a process's memory.

1. MITRE ATT&CK® Framework. (2023). Process Injection

Technique T1055. The MITRE Corporation. Retrieved from https://attack.mitre.org/techniques/T1055/.

Reference Specifics: The main description for Technique T1055 states

"Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process." This directly matches the question's definition.

2. Santos

O.

Stuppi

J.

& Pargman

T. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press.

Reference Specifics: Chapter 15

"Digital Forensics and Incident Response

" in the section "Types of Malware

" describes process injection as a common technique used by malware to hide its presence by running its code within the context of a legitimate process.

3. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press.

Reference Specifics: Chapter 17

"Malware-Focused Network Signatures

" and Chapter 20

"Covert Malware Launching

" detail process injection as a fundamental technique for malware to evade detection and maintain persistence by hiding within legitimate processes. This book is widely used in university cybersecurity curricula.