Windows Process Hollowing Suspected via Replaced In-Memory Image

title: Windows Process Hollowing Suspected via Replaced In-Memory Image
id: 91d4cb12-2bd9-4c13-ac2b-9b3d36aa4d43
status: test
description: This rule flags potential process hollowing on Windows when an event indicates the process image was replaced in memory. Attackers may use process hollowing to run malicious code while preserving a legitimate on-disk executable, making it harder to detect. The detection relies on telemetry that records process tampering events and the reported Image path, including exclusions for common benign executable locations.
references:
  - https://twitter.com/SecurePeacock/status/1486054048390332423?s=20
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S, Huntrule Team
date: 2022-01-25
modified: 2023-11-28
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.012
logsource:
  product: windows
  category: process_tampering
detection:
  selection:
    Type: Image is replaced
  filter_main_generic:
    Image|contains:
      - :\Program Files (x86)
      - :\Program Files\
      - :\Windows\System32\wbem\WMIADAP.exe
      - :\Windows\SysWOW64\wbem\WMIADAP.exe
  filter_optional_opera:
    Image|contains: \AppData\Local\Programs\Opera\
    Image|endswith: \opera.exe
  filter_optional_edge:
    Image|endswith: \WindowsApps\MicrosoftEdge.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c4b890e5-8d8c-4496-8c66-c805753817cd
    type: derived