MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1055Process Injection

StealthPrivilege Escalation

View on MITRE ATT&CK →

1 Query

Suspicious Process Injection Indicators in Command Line

highexperimentalDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any (
    "VirtualAllocEx", "WriteProcessMemory", "CreateRemoteThread",
    "NtMapViewOfSection", "QueueUserAPC", "SetThreadContext",
    "ReflectiveLoader", "-inject", "hollowing"
)
| where FileName !in~ ("MsMpEng.exe", "svchost.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| sort by Timestamp desc

Cyb3r-Monk (adapted) · last tested 2025-03-01

Tuning notes

Application compatibility shims and some security products use injection APIs legitimately. Correlate with process reputation and file signing status.

+ Add another query for this technique →