T1055.012 Process Hollowing
Sub-technique of T1055 Process Injection
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HackTool - CACTUSTORCH Remote Thread Creationhightest · windows
- Potential Pikabot Hollowing Activityhightest · windows
- HackTool - HollowReaper Executionhighexperimental · windows
- Uncommon Svchost Command Line Parameterhighexperimental · windows
- Potential Process Hollowing Activitymediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.