Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.
APC injection is commonly performed by attaching malicious code to the APC Queue [1] of a process's thread. Queued APC functions are executed when the thread enters an alterable state.[1] A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL).
A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. [2] AtomBombing [3] is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.[4]
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process.
| ID | Name | Description |
|---|---|---|
| S0438 | Attor |
Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.[5] |
| S1081 | BADHATCH |
BADHATCH can inject itself into a new |
| S1039 | Bumblebee |
Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.[8] |
| S0484 | Carberp |
Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.[9] |
| G0061 | FIN8 |
FIN8 has injected malicious code into a new svchost.exe process.[10] |
| S0483 | IcedID |
IcedID has used |
| S0260 | InvisiMole |
InvisiMole can inject its code into a trusted process via the APC queue.[12] |
| S0517 | Pillowmint |
Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.[13] |
| S1018 | Saint Bot |
Saint Bot has written its payload into a newly-created |
| S1085 | Sardonic |
Sardonic can use the |
| S0199 | TURNEDUP |
TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."[2] |
| S1207 | XLoader |
XLoader injects code into the APC queue using |
| ID | Mitigation | Description |
|---|---|---|
| M1040 | Behavior Prevention on Endpoint |
Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0100 | Behavioral Detection of Asynchronous Procedure Call (APC) Injection via Remote Thread Queuing | AN0277 |
Detects malicious injection behavior involving memory allocation, remote thread queuing via APC (e.g., QueueUserAPC), and altered thread context within another live process to execute unauthorized code under legitimate context. |