> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/process-injection.md).

# Process injection

Process Injection is described by MITRE \[[T1055](https://attack.mitre.org/techniques/T1055/)] as a privilege escalation and defence evasion technique. The idea of which is to inject untrusted code into the address space of a trusted process, potentially bypassing defence solutions and allowing the code to inherit the security context of the process's owner. There are many different techniques, some more sophisticated than others. The aim of this lesson is to introduce you to some of the more straight forward ones to get you familiar with the concept.\
\
The high-level steps required for process injection to be successful are to:

* Allocate a new region of memory in the process.
* Copy the shellcode into that region.
* Execute the shellcode (typically with a thread).