huntrule

Windows Process Hollowing Suspected via Replaced In-Memory Image

Alerts on Windows events where a process image is replaced in memory, suggesting possible process hollowing.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_tampering
Author
Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S (SigmaHQ), DRL 1.1
Published
2022-01-25
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags potential process hollowing on Windows when an event indicates the process image was replaced in memory. Attackers may use process hollowing to run malicious code while preserving a legitimate on-disk executable, making it harder to detect. The detection relies on telemetry that records process tampering events and the reported Image path, including exclusions for common benign executable locations.

Reporting behind it

Related detections9 linkedT1055.012 — drag to rearrange
Suspicious Execution of Dotnet Injection Target Utilities
Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)
Suspicious JScript.NET Compiler Spawned by AutoIt for Process Hollowing
PureHVNC Process Hollowing into RegAsm Spawned by PowerShell (via process_creation)
Suspicious DotNet Utility Spawned by Script Host for Hollowing (via process_creation)
Suspicious RegSvcs Reflective .NET Load from Fake Update Chain
In-Memory XWorm Injection Target RegAsm Spawned from User AppData (via process_creation)
Possible Process Injection Target RegAsm Launched Without Arguments via Process Creation
In-Memory Regasm Process Hollowing Spawned by PowerShell (via process_creation)
Windows Process Hollowing Suspected via Replaced In-Memory Image
Pivot detection · T1055.012 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.