A municipal IR playbook is tagging behaviors observed during a Defender-centric investigation. How should 'process injection family' techniques typically be categorized?
Select an answer to reveal the explanation.
Short Explanation
Process injection is usually the disguise act, not the front-door break-in. IR tickets should park it under evasion/anti-detection unless evidence says otherwise. Mixing it up with phishing delivery muddies the timeline.
Full Explanation
In a municipal IR playbook tagging behaviors during a Defender-centric investigation, process-injection family techniques should typically be categorized as anti-detection or defense-evasion behaviors rather than as initial access by themselves. Injection hides or runs code in the context of other processes to blend activity and bypass or complicate defenses. Delivery may have occurred earlier via phishing or another vector; injection describes a later or parallel evasion/execution concealment pattern unless evidence shows otherwise.
Treating process injection as the same stage as phishing email delivery collapses kill-chain clarity and muddies timelines. Claiming injection proves that network firewalls alone caused the endpoint alert is unsupported. Treating injection as mandatory evidence of a zero-day browser exploit in every case overclaims novelty and mechanism without proof.
Exam caveat: MITRE-style stage questions often place process injection under defense evasion (in ATT&CK v19 that tactic was split, and T1055 now sits under Stealth and Privilege Escalation); do not auto-map it to initial access or zero-day exploitation.
Operational check for municipal IR: tag injection under evasion/anti-detection; reconstruct earlier access and execution stages separately; collect process, module, and telemetry evidence; and avoid firewall-only or zero-day conclusions from injection artifacts alone.