Skip to content

Portable Executable Injection

Subtechnique · ATTACK:enterprise:T1055.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1055.002",
  "title": "Portable Executable Injection",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1055/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--806a49c4-970d-43f9-9acc-ac0ee11e6662",
  "external_id": "T1055.002",
  "domain": "enterprise",
  "created": "2020-01-14T01:27:31.344Z",
  "modified": "2026-05-12T15:12:00.665Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Elastic Process Injection July 2017",
      "url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
    }
  ]
}

Explicit source assertions (17)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06e74d66-012f-4615-9597-50c5fff9b036

Rapid7 Fake W2 July 2024

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e530e67-4e80-412f-8b38-fbc14085f05c

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ed82dd2-9b78-49a7-990b-d59ad7fa40a1

ESET InvisiMole June 2020

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54d857a4-d8d1-4234-b1e1-c8f4dd8f001e

Havoc Framework Documentation

ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5950182b-4e27-4d5e-87bb-c8598314622c

FireEye CARBANAK June 2017

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d580ddf-51b4-4849-b54f-a6fed828ba86

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5de38b67-dbc7-46bf-bb73-91cd0e069d05

Talos Rocke August 2018

ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88078d5c-bbc9-4c34-858f-e18d472d38d4

Unit 42 Gorgon Group Aug 2018

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e13c22e-5758-4e8f-920c-7dbab940b02b

BiZone Lizar May 2021

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a487371e-15c9-405a-8774-0827fea2c3a3

Sophos Gootloader

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5fe256f-67fa-4085-bb44-e05b399e66ca

CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · JPCERT SPAWNCHIMERA Ivanti February 2025

ATTACK:enterprise:S0342 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b37c1e66-774b-45ff-9c2a-b24ea9784963

ESET GreyEnergy Oct 2018

ATTACK:enterprise:S1158 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b718fd1e-03bb-47cc-908d-22e62b029142

Google Cloud APT41 2024

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d21794dc-278a-41c5-9707-17113f261d1d

Zscaler Pikabot 2023

ATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da69efe7-e99e-4d79-a455-c59f4c087b22

GDATA Zeus Panda June 2017

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eabeadf0-4061-496e-bfe8-e301076181c3

Mandiant 3cx UNC4736 2023 · GitHub SigFlip opensource tool

ATTACK:enterprise:T1055.002 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc26d209-c7fb-4d59-82da-0be7c72c651d

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.