Hunting For Process Injection Techniques

Mahipal

Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process telemetry. Use when hunting for in-memory code injection or defense evasion via legitimate process abuse on Windows endpoints.

Install

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-process-injection-techniques

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-process-injection-techniques -a claude-code -g

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-process-injection-techniques -a codex -g

gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-for-process-injection-techniques

gh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-for-process-injection-techniques

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-process-injection-techniques ~/.claude/skills/hunting-for-process-injection-techniques   # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-process-injection-techniques ~/.agents/skills/hunting-for-process-injection-techniques   # Codex, Cursor, Gemini CLI, Copilot, OpenCode

Install

Related