This repository contains all the code and data related to the publication:
Jerre Starink, Marieke Huisman, Andreas Peter, Andrea Continella. "Understanding and Measuring Inter-Process Code Injection in Windows Malware". Proceedings of the EAI International Conference on Security and Privacy in Communication Networks (SecureComm). 2023
Malware aims to stay undetected for as long as possible. One common method for avoiding or delaying detection is the use of code injection, by which a malicious process injects code into another running application. Despite code injection being known as one of the main features of today’s malware, it is often overlooked and no prior research performed a comprehensive study to fundamentally understand and measure code injection in Windows malware. In this paper, we conduct a systematic study of code injection techniques and propose the first taxonomy to group these methods into classes based on common traits. Then, we leverage our taxonomy to implement models of the studied techniques and collect empirical evidence for the prevalence of each spe- cific technique in the malware scene. Finally, we perform a large-scale, longitudinal measurement of the adoption of code injection, highlighting that at least 9.1% of Windows malware between 2017 and 2021 performs code injection. Our systematization and results show that Process Hollowing is the most commonly used technique across different malware families, but, more importantly, this trend is shifting towards other, less traditional methods. We conclude with takeaways that impact how future malware research should be conducted. Without comprehensively accounting for code injection and modeling emerging techniques, future studies based on dynamic analysis are bound to limited observations.
The repository is structured in the following manner:
src: Contains all the source code required to run the samples, analyze them individually as well as collectively. It also contains various sample implementations of the studied code injection techniques.data: Contains the resulting reports, sample hashes and detected code injection techniques.
In the individual directories you can find README files with further information specifically.