Is it possible to determine the process that performed DLL injection against a victim process?


It depends when you need to detect it, when it is happening or after the fact.

Live detection is much easier because you can hook system functions that are used to inject DLLs and log the information. When a process debugs itself, it will get notifications when DLLs are loaded. Or you can list DLLs periodically and see differences. There are many methods of injection and avoiding detection and detection is always behind.

Detecting injection and who did it after the fact is very difficult if not impossible for some methods. There isn't something as a log to store the details of what processes do. I'm sure some injection methods leave forensic artefacts behind, but for the most methods, you are lucky if you can detect traces of the injection itself, not to mention who did it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.