Cynet Interview Prep

Process Injection

A technique used by malware to execute code within the address space of another process. (stealthier, evades detection)

Process injection is a technique where () is placed into a legitimate running process so that it executes under that process’s (). Attackers use it to...

malicious code; identity

• hide activity

• bypass process-based defenses

• gain the target process’s privileges (sometimes)

Common Process Injection Targets

• web browsers

• office applications

• system utilities (like explorer.exe)

• security tools

• long-lived background services

Attackers prefer processes that are…

• trusted

• have high privileges

• are always running (increase stealth and persistence)

Attackers use process injection to…

• evade detection

• gain or maintain elevated privileges

• access sensitive data handled by the target process.

  • bypass application whitelisting

  • exploit the trust in legitimate processes

Classic DLL injection

Loads a malicious .dll into a target process, often via Windows APIs such as CreateRemoteThread and LoadLibrary . Once loaded, the DLL's code runs in the context of the target process and can perform malicious actions stealthily.

() loads a malicious .dll into a target process, often via () such as () and (). Once loaded, the DLL's code runs in the context of the target process and can perform malicious actions stealthily.

Classic DLL injection; Windows APIs; CreateRemoteThread; LoadLibrary

Code Injection via Remote Thread Creation (Remote Thread Injection)

An attacker writes shellcode into a target process's memory and starts a new thread there.

In remote thread injection, an attacker writes (x) into a target process's () and starts a new thread there, commonly using…

The (x) then executes inside the target process, inheriting its privileges.

shellcode; memory;

• OpenProcess

• Virtual AllocEx

• WriteProcessMemory

• CreateRemoteThread

Process Hollowing

Creates a legitimate process in a suspended state, removes its original code, and replaces it with malicious code before resuming execution. The resulting process appears benign by name and metadata but actually runs the attacker's payload.

Process hollowing… (steps).

The resulting process appears benign by () and (), but actually runs the attacker's payload.

1. creates a legitimate process in a suspended state

2. removes its original code

3. replaces it with malicious code

4. resumes execution

name; metadata

Detection Clues: Suspicious API Usage

• Unusual use of Windows APIs targeting other processes

  • OpenProcess

  • Virtual AllocEx

  • WriteProcessMemory

  • Create RemoteThread

  • SetThreadContext

• Frequent cross-process memory operations (especially involving high-value processes)

Detection Clues: Memory and Module Anomalies

• executable memory regions in a process not backed by known modules

• unsigned or oddly named DLLs loaded into sensitive processes

• mismatches between on-disk and in-memory modules

• unexpected threads or start addresses within non-standard regions

If I were defending the environment…

I’d assume the attacker will try phishing or exposed remote access first, then use stolen credentials, move laterally, and blend in with legitimate tools. I’d prioritize identity protections, patching, MFA, segmentation, and endpoint detection focused on process and memory behavior.

What to inspect for a phishing analysis:

• Display name versus actual sender domain.

• Reply-to mismatches.

• Link destination versus visible text.

• Attachment type and whether it is expected.

• Brand impersonation, urgency, payment pressure, or password-reset prompts.

• Whether the message originated from a newly observed or unusual IP or ASN.

For phishing analysis…

I look for sender-domain anomalies, authentication results, suspicious links or attachments, and abnormal source infrastructure. I also treat pass/fail SPF, DKIM, and DMARC as one input, not proof of legitimacy, because attackers may still deliver convincing phishing through compromised accounts or lookalike domains.

Malicous IPs (Phishing)

By itself is useful context, but it should not be the only signal. Reputation data can lag behind fast-changing IOCs. Attackers use cloud hosting, residential proxies, or short-lived infrastructure, so change fast That means you should combine IP reputation with message authentication results, URL analysis, sender history, and user-targeting patterns

A malicious IP by itself is useful context, but it should not be the only signal. IOCs change fast and reputation data can lag behind. Some attackers use…

That means you should…

• cloud hosting

• residential proxies

• short-lived infrastructure

• combine IP reputation with message authentication results

• URL analysis

• sender history

• user-targeting patterns

Residential Proxies

Proxy servers that route your traffic through IP addresses assigned by internet service providers to real homes or devices, so websites see the request as coming from a normal residential user rather than a datacenter. They’re commonly used for web scraping, geo-testing, ad verification, and other tasks where traffic from a household IP is less likely to be blocked.

Attackers commonly find remote access by…

• scanning the internet for exposed services

• using search engines for internet-facing assets

• checking leaked credentials

• abusing third-party/vendor access paths

If a service is reachable from the internet, it can be discovered sooner or later by automated scanning. That means the controls that matter most are…

• MFA

• conditional access

• IP allowlisting

• VPN hardening

• RDP removal from direct internet exposure

• logging

• continuous external attack surface monitoring

“An attacker usually doesn’t need to know in advance that a VPN or RDP service is exposed; they find it through…

As a defender, I assume internet-facing remote access will be found and focus on () and ().

• broad scanning

• OSINT

• credential theft

• vendor compromise.

reducing exposure; tightening authentication

MITRE ATT&CK Framework

A globally accessible knowledge base that categorizes adversary tactics, techniques, and procedures (TTPs) based on real-world observations, used for threat modeling, detection engineering, and security assessments.

ATT&CK Tactics

High-level adversary goals or objectives during an attack (e.g., Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Impact).

ATT&CK Techniques And Sub-techniques

Specific methods adversaries use to achieve a tactic, with sub-techniques giving further detail (e.g., Phishing under Initial Access, with Spearphishing Attachment as a sub- technique).

Microsoft 365 Compromise Chain

An attack pattern where adversaries gain initial access via phishing or credential stuffing, establish persistence using app passwords or OAuth consent grants, perform mailbox discovery and data collection, and exfiltrate sensitive information or use accounts for further attacks.

MITRE ATT&CK Framework

A globally curated knowledge base of adversary behaviors, organized into tactics, techniques, and sub-techniques. It helps defenders map observed activity, improve detections, and standardize incident response reporting.

ATT&CK Tactic

A high-level adversary goal during an intrusion (e.g., Initial Access, Execution, Persistence). Tactics correspond to why an attacker performs an action, not how.

ATT&CK Technique

A specific way adversaries achieve a tactic, such as using valid accounts for persistence or running scripts for execution. Techniques often have sub-techniques that describe more detailed implementations.

Phishing for Initial Access (Windows/M365)

Use of malicious emails, links, or attachments to trick users into executing code or providing credentials. In M365, this often involves weaponized Office documents, credential- harvesting pages, or OAuth consent phishing.

Windows PowerShell Abuse

Using PowerShell to download, execute, and obfuscate malicious payloads, often living off the land. Incident responders should monitor PowerShell logging, script block logs, and suspicious encoded command lines.

M365 OAuth Application Abuse

Adversaries create or consent to malicious Azure AD/M365 apps to gain persistent API access to mailboxes or files. Key indicators include unusual consent prompts, new app registrations, and high-volume API calls.

Windows Credential Dumping via LSASS

Extracting passwords or hashes from the LSASS process memory using tools like Mimikatz. Relevant detections include suspicious access to LSASS, use of signed- but-abused admin tools, and abnormal handle operations.