Process injection: running code in another process

Injecting code into a legitimate process (explorer.exe, a browser) lets you run under its identity, inherit its privileges and blend in.

The canonical technique

h = OpenProcess(target)
p = VirtualAllocEx(h, ..., PAGE_EXECUTE_READWRITE)
WriteProcessMemory(h, p, shellcode, ...)
CreateRemoteThread(h, ..., p, ...)

Stealthier variants avoid CreateRemoteThread: APC injection (queue a function on an existing thread), thread hijacking (suspend a thread, change its context), shared-section mapping.

Defence

EDRs watch the VirtualAllocEx+WriteProcessMemory+CreateRemoteThread sequence and RWX regions. CFG, blocking unsigned code (WDAC), and Defender ASR rules reduce the surface. RWX allocations in a process are a strong indicator.