{"id":"T1055.012","name":"Process Hollowing","url":"https://attack.mitre.org/techniques/T1055/012","tactics":["stealth","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0382","stix_id":"x-mitre-detection-strategy--8e003575-5a6f-458d-be35-a8606c9b7dea","name":"Detection Strategy for Process Hollowing on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0382","analytics":[{"id":"AN1076","stix_id":"x-mitre-analytic--bcb01d01-66f6-47bb-9ca1-46b4ce686ad4","name":"Analytic 1076","description":"Detects adversary use of suspended process creation, using the CREATE_SUSPENDED flag via CreateProcess, followed by unmapping the memory of the child process (NtUnmapViewOfSection) and replacing it with malicious code via VirtualAllocEx/WriteProcessMemory, then SetThreadContext and ResumeThread to begin execution within the hollowed process.","url":"https://attack.mitre.org/detectionstrategies/DET0382#AN1076","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=8","data_component":"DC0020","data_component_name":"Process Modification","log_source_slug":"wineventlog-sysmon"},{"name":"etw:Microsoft-Windows-Kernel-Process","channel":"NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-microsoft-windows-kernel-process"}],"mutable_elements":[{"field":"HollowedImageNamePattern","description":"Regex to match common decoy executables used for hollowing (e.g., 'svchost.exe', 'notepad.exe')"},{"field":"TimeWindow_ProcessCreateToResume","description":"Temporal threshold for unmap/write/execute sequence (e.g., within 5–10 seconds)"},{"field":"SuspendedProcessStartFlag","description":"CreateProcess flag used to identify suspended thread creation"},{"field":"MemoryWriteSizeThreshold","description":"Minimum byte size to flag suspicious memory overwrite in hollowed process"}],"live":true,"detection_strategies":["DET0382"],"techniques":["T1055.012"]}],"live":true,"version":"1.0","techniques":["T1055.012"]}],"sigma_rules":[{"id":"2e4e488a-6164-4811-9ea1-f960c7359c40","title":"HackTool - CACTUSTORCH Remote Thread Creation","author":"@SBousseaden (detection), Thomas Patzke (rule)","status":"test","level":"high","date":"2019-02-01","modified":"2023-05-05","description":"Detects remote thread creation from CACTUSTORCH as described in references.","references":["https://twitter.com/SBousseaden/status/1090588499517079552","https://github.com/mdsecactivebreach/CACTUSTORCH"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.privilege-escalation","attack.execution","attack.stealth","attack.t1055.012","attack.t1059.005","attack.t1059.007","attack.t1218.005"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml","techniques":["T1055.012","T1059.005","T1059.007","T1218.005"],"cves":[]},{"id":"85d23b42-9a9d-4f8f-b3d7-d2733c1d58f5","title":"HackTool - HollowReaper Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-07-01","modified":null,"description":"Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing.\nIt replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.\n","references":["https://github.com/vari-sh/RedTeamGrimoire/tree/b5e7635d34db6e1f0398d8847e8f293186e947c5/HollowReaper"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.012"],"path":"rules/windows/process_creation/proc_creation_win_hktl_hollowreaper.yml","techniques":["T1055.012"],"cves":[]},{"id":"c4b890e5-8d8c-4496-8c66-c805753817cd","title":"Potential Process Hollowing Activity","author":"Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S","status":"test","level":"medium","date":"2022-01-25","modified":"2023-11-28","description":"Detects when a memory process image does not match the disk image, indicative of process hollowing.","references":["https://twitter.com/SecurePeacock/status/1486054048390332423?s=20","https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/"],"logsource":{"product":"windows","category":"process_tampering"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.012"],"path":"rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml","techniques":["T1055.012"],"cves":[]},{"id":"d8937fe7-42d5-4b4d-8178-e089c908f63f","title":"Potential Pikabot Hollowing Activity","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"high","date":"2023-10-27","modified":"2024-01-26","description":"Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries.\nThe malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries\n","references":["https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62","https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b","https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.012","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml","techniques":["T1055.012"],"cves":[]},{"id":"f17211f1-1f24-4d0c-829f-31e28dc93cdd","title":"Uncommon Svchost Command Line Parameter","author":"Liran Ravich","status":"experimental","level":"high","date":"2025-11-14","modified":"2026-03-23","description":"Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.\nThis could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.\n","references":["https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/","https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware","https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/","https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1036.005","attack.t1055","attack.t1055.012"],"path":"rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml","techniques":["T1036.005","T1055","T1055.012"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-0386","state":"stale","mapping_types":["exploitation_technique"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}