Procedure examples

DOWNIISSA can inject shellcode directly into process memory including WINWORD.exe and msiexec.exe.

BBK has the ability to inject shellcode into svchost.exe.

Waterbear can inject decrypted shellcode into the LanmanServer service.

Lizar can migrate the loader into another process.

WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.

SLOTHFULMEDIA can inject into running processes on a compromised host.

Sliver includes multiple methods to perform process injection to migrate the framework into other, potentially privileged processes on the victim machine.

SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.

Empire contains multiple modules for injecting into processes, such as Invoke-PSInject.

The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.

PoshC2 contains multiple modules for injecting into processes, such as Invoke-PSInject.

Remcos has a command to hide itself by injecting into another process.

Donut includes a subproject DonutTest to inject shellcode into a target process.

IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.

HTRAN can inject into into running processes.