T1055 Process Injection

2 threats tracked by Spectrum Delta use this technique.

T1055 on MITRE ATT&CK →

• Yoba signed-AI sideload

  Tasking injects payload into svchost.exe

  Sysmon EID 8 (CreateRemoteThread into svchost.exe) + EID 10 process-access events; EID 1 alone does not prove injection

  Seen in: Windows remote thread / process access

• Lazarus FlashHole

  CrossWeb EX spawns fsquirt.exe with injected shellcode

  Sysmon EID 1: fsquirt.exe with parent INISAFECrossWebEXSvc.exe; injection evidence only if the mechanism produces observable events (e.g., EID 8) — not established in the report

  Seen in: Sysmon / EDR