Inside the Target
Difficulty: hard
Topics: T1055.002 - Process Injection: Portable Executable Injection
Problem statement
A workstation alert indicates suspicious behavior originating from a trusted application
Initial investigation shows no anomalies in the application's parent process and no obvious malicious executable on disk
However, shortly after the legitimate application starts, its behavior changes unexpectedly
Further investigation suggests that code not belonging to the application's original execution flow is being executed within the process itself
The source of the code and the mechanism used to introduce it are not immediately visible through traditional process telemetry
The defensive team has asked you to develop a runtime detection hook capable of identifying process injection activity, regardless of which Windows API or injection technique is used to introduce and execute the code
Your objective is to research how process injection techniques establish execution inside another process, identify the common runtime behaviors shared by different injection methods, and develop instrumentation that can expose suspicious code execution occurring within a legitimate process
OBJECTIVES: You must: - Research Process Injection techniques and understand how malicious code can execute within the context of another process. - Identify the common runtime behaviors shared by different process injection techniques. - Determine how a defender can distinguish legitimate cross-process activity from suspicious code injection. - Identify the source and target processes involved in suspicious cross-process activity. - Investigate how memory is allocated, modified, or prepared for execution inside another process. - Develop runtime instrumentation capable of detecting suspicious code execution occurring within a legitimate process. - Correlate injection-related activity with the source process, target process, parent process, and process ancestry. - Understand why monitoring a single injection API is insufficient when attempting to detect multiple process injection techniques. - Build a defensive detection approach that focuses on detecting any code injection technique. - Determine how legitimate software can perform similar cross-process operations without being incorrectly classified as malicious.
How to solve this challenge
Open the in-browser IDE on this page, write your solution in C or C++, and click Run. A sandboxed agent compiles your code and executes it against the target while streaming live stdout, stderr, hook traces, and verification results over a WebSocket. When your implementation succeeds, the flag is surfaced automatically.
Who is this challenge for?
Detection engineers, blue team analysts, malware researchers, security engineers, and operators who want hands-on practice with T1055.002 - Process Injection: Portable Executable Injection.