T1055.005No distinct observable

Thread Local Storage

Stealth · Privilege EscalationWindows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

AN1289's observable is a memory write to another process's PE header and TLS directory, and none of the three log sources in the brief records memory content or memory writes. Sysmon EID 7 (image_load) reports which module was mapped and how it was signed, not that a callback pointer inside an already-mapped image was rewritten. Sysmon EID 8 (create_remote_thread) cannot fire for this technique by construction: the whole point of a TLS callback is that the loader runs it on thread attach inside the target, so no remote thread is created. That leaves Sysmon EID 10, where the only expressible signal is a cross-process handle carrying write rights — which is not TLS-specific and is already published in this corpus as T1055.001 (full-access and minimal write plus create-thread masks on a system process) and T1055.002 (write-rights handle from an unbacked call stack). […]

Covered instead by T1055.012, T1055.001, T1055.002.

What the technique is

Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process. TLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. TLS callbacks are normally used by the OS to setup and/or cleanup data used by threads. Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other Process Injection techniques such as Process Hollowing. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process.

Read it on attack.mitre.org

What MITRE says you would watch

AN1289
Detects thread local storage (TLS) callback injection by monitoring memory modifications to PE headers and TLS directory structures during or after process hollowing events, followed by anomalous thread behavior prior to main entry point execution.