Atomic Red T1055

Invoke-AtomicTest T1055

Runs the process injection atomic tests (T1055) with Atomic Red Team, validating host-based detection of the injection.

Run it in the purple team lab when you want to validate process injection detection: the T1055 atomics replicate the variants (CreateRemoteThread, hollowing, PowerShell injection) and the team verifies what was detected — Sysmon Event 8 (CreateRemoteThread), Event 10, the EDR. It's the detection validation for injection: the real technique executed and coverage measured. In purple teaming, the T1055 atomics validate the injection rules and the result feeds the matrix.

Don't run it in production: process injection generates real events and EDRs may block it or treat it as an incident — the lab is the place. The noise is planned. And watch out: T1055 is a family of variants (sub-techniques and methods): each atomic validates one variant — coverage is validated per method (CreateRemoteThread, hollowing). Injection with modern techniques (without the classic events) requires the specific atomics. Detection of Sysmon Event 8 (the CreateRemoteThread call) is the classic rule being validated; its absence is the gap.