huntrule

Windows Process Hollowing Suspected via Replaced In-Memory Image

Alerts on Windows events where a process image is replaced in memory, suggesting possible process hollowing.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_tampering
Author
Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S (SigmaHQ), DRL 1.1
Published
2022-01-25
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags potential process hollowing on Windows when an event indicates the process image was replaced in memory. Attackers may use process hollowing to run malicious code while preserving a legitimate on-disk executable, making it harder to detect. The detection relies on telemetry that records process tampering events and the reported Image path, including exclusions for common benign executable locations.

Reporting behind it

Related detections9 linkedT1055.012 — drag to rearrange
Suspicious MSBuild Spawned by PowerShell (via process_creation)
Suspicious RegSvcs Execution Spawned by Script Interpreter for Process Hollowing (via process_creation)
Suspicious MSBuild Execution Spawned by PowerShell via PhantomVAI Loader (via process_creation)
Suspicious Rundll32 Loading Non-DLL Image Extension File
Suspicious MSBuild Execution Spawned by Command Shell for Process Hollowing (via process_creation)
Malicious Desktop Window Manager Impersonation From Non-System Path via process_creation
Suspicious .NET Utility Spawned by AutoHotkey Loader for Process Hollowing (via process_creation)
Suspicious csc.exe Spawned by Document Reader for Process Injection
Suspicious RegAsm Execution Spawned by Script Host for Process Hollowing (via process_creation)
Windows Process Hollowing Suspected via Replaced In-Memory Image
Pivot detection · T1055.012 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.