T1055: StealC Process Injection into explorer.exe or svchost.exe via CreateRemoteThread

Tim Peck@timpeck

•updated Jul 23, 2026•4•0•15

Detects cross-process memory operations and CreateRemoteThread calls targeting explorer.exe or svchost.exe from non-standard (untrusted) process paths. This activity is consistent with StealC infostealer unpacking and injection behavior, typically following initial execution by SmartLoader as seen in recent FakeGit/AgentBaiting campaigns.