Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1055.002_portable-executable-injection
Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.
Passed 19 of 22 test cases with the skill, and 15 of 22 without it.
and 2 more in the full report
4 fixed15 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
During automated execution of Atomic Red Team tests for PE injection, what visual confirmation artifact appears on screen upon successful injection into the target process?
| Checked | Without skill | With skill |
|---|---|---|
| The response states a message box appears with the title Warning. | Missed | Passed |
| The response states the message box content contains Atomic Red Team. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1055
Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.
PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
This test injects a portable executable into a remote Notepad process memory using Portable Executable Injection and base-address relocation techniques. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds.
Supported Platforms: windows Elevation Required: Yes
test cases passed, vs 15 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.