System Activity > Process: Handling Injection Attributes

[mikeradka]

Currently, System Activity > Process Activity events have an Inject activity for injection events.

The Mitre Process Injection Technique defines Process Injection as

> "a method of executing arbitrary code in the address space of a separate live process."

It was expressed that there is a need to accurately map properties of an injection - namely the Injection Path.

Currently, the Process Activity Class has two injection attributes: injection_type and injection_type_id, but no discreet attribute for Injection Path:

Three approaches which came up in partner discussions are:

1. Keep the schema as is. In mapping implementation, actor_process injects module into the target process
2. Add an injection_path attribute to the Process Activity class (would mean one structural change - an addition)
3. Make an injection object with .path, .type, and .type_id attributes (would mean multiple structural changes, creating a new object and moving attributes into it)
4. Like 1. Keep the structure of the schema as is. In mapping implementation, actor_process injects module into the target process. In Addition, update the definition of process to "The process that was launched, injected into, opened, or terminated."

[mikeradka]

In any case, the definitions of actor_process and process were misleading and thus were updated in #172

Old Definitions:

• actor_process: The process that performed the operation or action on the target object. For example, the process that could have created a new file or violated a policy.
• process: The process that was launched, injected, opened, or terminated.

New Definitions:

• actor_process: The process that performed the operation or action on the target process. For example, the process that could have started a new process or injected code into another process.
• process: The process that was launched, injected into, opened, or terminated.

[JasonKeirstead]

Isn't a fifth option to change the type of injection_type to be an external reference that points at T1055 sub techniques?

Why re-invent something already well defined and maintained.

[mikeradka]

I believe this one is being discussed in some of the subsequent discussions more specific to 'injection_type_id'.

[mikeradka]

Putting this one to bed, as we addressed the main issue of injection_path in the implementation of module.