Windows Process Hollowing Suspected via Replaced In-Memory Image

Alerts on Windows events where a process image is replaced in memory, suggesting possible process hollowing.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_tampering
Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S (SigmaHQ), DRL 1.1
Published: 2022-01-25
Updated: 2026-07-30

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055.012Process Hollowing
Defense Evasion
- T1055.012Process Hollowing
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags potential process hollowing on Windows when an event indicates the process image was replaced in memory. Attackers may use process hollowing to run malicious code while preserving a legitimate on-disk executable, making it harder to detect. The detection relies on telemetry that records process tampering events and the reported Image path, including exclusions for common benign executable locations.

Reporting behind it

Related detections9 linkedT1055.012 — drag to rearrange

Suspicious Execution of Dotnet Injection Target Utilities

Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)

Suspicious JScript.NET Compiler Spawned by AutoIt for Process Hollowing

PureHVNC Process Hollowing into RegAsm Spawned by PowerShell (via process_creation)

Suspicious DotNet Utility Spawned by Script Host for Hollowing (via process_creation)

Suspicious RegSvcs Reflective .NET Load from Fake Update Chain

In-Memory XWorm Injection Target RegAsm Spawned from User AppData (via process_creation)

Possible Process Injection Target RegAsm Launched Without Arguments via Process Creation

In-Memory Regasm Process Hollowing Spawned by PowerShell (via process_creation)

Windows Process Hollowing Suspected via Replaced In-Memory Image

Pivot detection · T1055.012 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-hollowing-suspected-via-replaced-in-memory-image-c4b890e5

title: Windows Process Hollowing Suspected via Replaced In-Memory Image
id: 91d4cb12-2bd9-4c13-ac2b-9b3d36aa4d43
status: test
description: This rule flags potential process hollowing on Windows when an event indicates the process image was replaced in memory. Attackers may use process hollowing to run malicious code while preserving a legitimate on-disk executable, making it harder to detect. The detection relies on telemetry that records process tampering events and the reported Image path, including exclusions for common benign executable locations.
references:
  - https://twitter.com/SecurePeacock/status/1486054048390332423?s=20
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S, Huntrule Team
date: 2022-01-25
modified: 2023-11-28
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.012
logsource:
  product: windows
  category: process_tampering
detection:
  selection:
    Type: Image is replaced
  filter_main_generic:
    Image|contains:
      - :\Program Files (x86)
      - :\Program Files\
      - :\Windows\System32\wbem\WMIADAP.exe
      - :\Windows\SysWOW64\wbem\WMIADAP.exe
  filter_optional_opera:
    Image|contains: \AppData\Local\Programs\Opera\
    Image|endswith: \opera.exe
  filter_optional_edge:
    Image|endswith: \WindowsApps\MicrosoftEdge.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c4b890e5-8d8c-4496-8c66-c805753817cd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL