← Back to ATT&CK index
T1055.002sub-technique
Portable Executable Injection
View on attack.mitre.org →4 syscalls implement this technique
- NtAllocateVirtualMemory
Reserves, commits or both a region of virtual memory in a target process.
- NtProtectVirtualMemory
Changes the protection on a region of committed virtual memory in a target process.
- NtWriteVirtualMemory
Writes a buffer from the caller into the virtual address space of a target process.
- NtCreateThreadEx
Creates a new thread in a target process, optionally suspended, with rich attribute list support.