Procedure examples

Lizar has used the PowerKatz plugin that can be loaded into the address space of a PowerShell process through reflective DLL loading.

PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.

IronNetInjector has the ability to inject a DLL into running processes, including the IronNetInjector DLL into explorer.exe.

Koadic can perform process injection by using a reflective DLL.

Pupy can migrate into another process using reflective DLL injection.

Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).