Code Injection

Adversaries may use code injection attacks to implant arbitrary code into the address space of a running application. Code is then executed or interpreted by that application. Adversaries utilizing this technique may exploit capabilities to load code in at runtime through dynamic libraries.

With root access, ptrace can be used to target specific applications and load shared libraries into its process memory.[1][2] By injecting code, an adversary may be able to gain access to higher permissions held by the targeted application by executing as the targeted application. In addition, the adversary may be able to evade detection or enable persistent access to a system under the guise of the application’s process.[3]

ID: T1540
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
Tactics: Persistence, Privilege Escalation, Defense Evasion
Platforms: Android, iOS
Version: 1.0
Created: 30 October 2019
Last Modified: 29 March 2020

Procedure Examples

Name Description
INSOMNIA

INSOMNIA grants itself permissions by injecting its hash into the kernel’s trust cache.[5]

Triada

Triada injects code into the Zygote process to effectively include itself in all forked processes. Additionally, code is injected into the Android Play Store App, web browser applications, and the system UI application.[3][4]

Mitigations

Mitigation Description
Application Vetting

Static or dynamic code analysis to look for misuse of dynamic libraries. Increased focus on applications utilizing DexClassLoader.

Detection

Code injection can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

References