[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HEBEAWJSBWNPSCP0RMTZJ5":3,"skill-same:01M6HEBEAWJSBWNPSCP0RMTZJ5":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6HEBEAWJSBWNPSCP0RMTZJ5","detecting-process-hollowing-technique",null,"Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"detecting","process","detecting process hollowing technique","indicators","hunting","detect","segment","id","platform","cm","analysis","memory","edr","process-injection","mitre-attack","monitoring","verification","code","telemetry","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-process-hollowing-technique\ndescription: Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child process anomalies in EDR telemetry.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- mitre-attack\n- process-hollowing\n- process-injection\n- edr\n- t1055\n- proactive-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Platform Monitoring\n- Process Code Segment Verification\n- Segment Address Offset Randomization\n- Process Analysis\n- Application Hardening\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1055\ncategory: detecting-process-hollowing-technique\n---\n# Detecting Process Hollowing Technique\n\n## When to Use\n\n- When investigating suspected fileless malware or in-memory threats\n- After EDR alerts on process injection or suspicious memory operations\n- When hunting for defense evasion techniques in a compromised environment\n- When threat intel reports indicate process hollowing in active campaigns\n- During purple team exercises validating T1055.012 detection coverage\n\n## Prerequisites\n\n- EDR with memory protection monitoring (CrowdStrike, MDE, SentinelOne)\n- Sysmon with Event IDs 1 (Process Create), 8 (CreateRemoteThread), 25 (ProcessTampering)\n- Windows ETW providers for process hollowing (Microsoft-Windows-Kernel-Process)\n- Memory forensics capabilities (Volatility, WinDbg)\n- Process integrity monitoring tools\n\n## Workflow\n\n1. **Understand Hollowing Mechanics**: Process hollowing involves creating a legitimate process in suspended state, unmapping its memory, writing malicious code, then resuming execution.\n2. **Monitor Suspended Process Creation**: Hunt for processes created with CREATE_SUSPENDED flag followed by memory writes and thread resumption.\n3. **Detect Memory Section Anomalies**: Identify processes where the in-memory image differs from the on-disk binary (image mismatch).\n4. **Analyze Parent-Child Process Trees**: Flag processes whose behavior does not match their binary name (e.g., svchost.exe making unusual network connections).\n5. **Check Process Integrity**: Compare process memory sections against the legitimate binary on disk.\n6. **Correlate with Network Activity**: Hollowed processes often establish C2 connections - correlate suspicious process behavior with network logs.\n7. **Document and Contain**: Report findings, isolate affected endpoints, and update detection rules.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1055.012 | Process Injection: Process Hollowing |\n| T1055 | Process Injection (parent technique) |\n| T1055.001 | DLL Injection |\n| T1055.003 | Thread Execution Hijacking |\n| T1055.004 | Asynchronous Procedure Call |\n| CREATE_SUSPENDED | Windows flag to create a process in suspended state |\n| NtUnmapViewOfSection | API to unmap process memory sections |\n| WriteProcessMemory | API to write into another process's memory |\n| ResumeThread | API to resume a suspended thread |\n| Image Mismatch | Process memory content differs from on-disk binary |\n| Process Doppelganging | Related technique using NTFS transactions (T1055.013) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | Memory protection and hollowing detection |\n| Microsoft Defender for Endpoint | ProcessTampering alerts |\n| Sysmon v13+ | Event ID 25 ProcessTampering detection |\n| Volatility | Memory forensics - malfind plugin |\n| pe-sieve | Process memory scanner for hollowed processes |\n| Hollows Hunter | Automated hollowed process detection |\n| Process Hacker | Live process memory inspection |\n| API Monitor | Monitor NtUnmapViewOfSection calls |\n\n## Common Scenarios\n\n1. **Svchost.exe Hollowing**: Malware creates svchost.exe suspended, hollows it, injects backdoor code - process appears legitimate but behaves maliciously.\n2. **Explorer.exe Hollowing**: Attacker hollows explorer.exe to inherit its network permissions and trusted process context.\n3. **Rundll32 Hollowing**: Malicious loader creates rundll32.exe, replaces its memory with implant code for C2 beaconing.\n4. **Multi-Stage Hollowing**: Loader uses process hollowing as first stage, then performs additional injection into services.\n\n## Output Format\n\n```\nHunt ID: TH-HOLLOW-[DATE]-[SEQ]\nTechnique: T1055.012\nHollowed Process: [Process name and PID]\nOriginal Binary: [Expected on-disk path]\nParent Process: [Parent name and PID]\nMemory Mismatch: [Yes\u002FNo]\nSuspicious APIs: [NtUnmapViewOfSection, WriteProcessMemory, etc.]\nNetwork Activity: [C2 connections if any]\nHost: [Hostname]\nUser: [Account context]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n","# Detecting Process Hollowing Technique\n\n## When to Use\n\n- When investigating suspected fileless malware or in-memory threats\n- After EDR alerts on process injection or suspicious memory operations\n- When hunting for defense evasion techniques in a compromised environment\n- When threat intel reports indicate process hollowing in active campaigns\n- During purple team exercises validating T1055.012 detection coverage\n\n## Prerequisites\n\n- EDR with memory protection monitoring (CrowdStrike, MDE, SentinelOne)\n- Sysmon with Event IDs 1 (Process Create), 8 (CreateRemoteThread), 25 (ProcessTampering)\n- Windows ETW providers for process hollowing (Microsoft-Windows-Kernel-Process)\n- Memory forensics capabilities (Volatility, WinDbg)\n- Process integrity monitoring tools\n\n## Workflow\n\n1. **Understand Hollowing Mechanics**: Process hollowing involves creating a legitimate process in suspended state, unmapping its memory, writing malicious code, then resuming execution.\n2. **Monitor Suspended Process Creation**: Hunt for processes created with CREATE_SUSPENDED flag followed by memory writes and thread resumption.\n3. **Detect Memory Section Anomalies**: Identify processes where the in-memory image differs from the on-disk binary (image mismatch).\n4. **Analyze Parent-Child Process Trees**: Flag processes whose behavior does not match their binary name (e.g., svchost.exe making unusual network connections).\n5. **Check Process Integrity**: Compare process memory sections against the legitimate binary on disk.\n6. **Correlate with Network Activity**: Hollowed processes often establish C2 connections - correlate suspicious process behavior with network logs.\n7. **Document and Contain**: Report findings, isolate affected endpoints, and update detection rules.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1055.012 | Process Injection: Process Hollowing |\n| T1055 | Process Injection (parent technique) |\n| T1055.001 | DLL Injection |\n| T1055.003 | Thread Execution Hijacking |\n| T1055.004 | Asynchronous Procedure Call |\n| CREATE_SUSPENDED | Windows flag to create a process in suspended state |\n| NtUnmapViewOfSection | API to unmap process memory sections |\n| WriteProcessMemory | API to write into another process's memory |\n| ResumeThread | API to resume a suspended thread |\n| Image Mismatch | Process memory content differs from on-disk binary |\n| Process Doppelganging | Related technique using NTFS transactions (T1055.013) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | Memory protection and hollowing detection |\n| Microsoft Defender for Endpoint | ProcessTampering alerts |\n| Sysmon v13+ | Event ID 25 ProcessTampering detection |\n| Volatility | Memory forensics - malfind plugin |\n| pe-sieve | Process memory scanner for hollowed processes |\n| Hollows Hunter | Automated hollowed process detection |\n| Process Hacker | Live process memory inspection |\n| API Monitor | Monitor NtUnmapViewOfSection calls |\n\n## Common Scenarios\n\n1. **Svchost.exe Hollowing**: Malware creates svchost.exe suspended, hollows it, injects backdoor code - process appears legitimate but behaves maliciously.\n2. **Explorer.exe Hollowing**: Attacker hollows explorer.exe to inherit its network permissions and trusted process context.\n3. **Rundll32 Hollowing**: Malicious loader creates rundll32.exe, replaces its memory with implant code for C2 beaconing.\n4. **Multi-Stage Hollowing**: Loader uses process hollowing as first stage, then performs additional injection into services.\n\n## Output Format\n\n```\nHunt ID: TH-HOLLOW-[DATE]-[SEQ]\nTechnique: T1055.012\nHollowed Process: [Process name and PID]\nOriginal Binary: [Expected on-disk path]\nParent Process: [Parent name and PID]\nMemory Mismatch: [Yes\u002FNo]\nSuspicious APIs: [NtUnmapViewOfSection, WriteProcessMemory, etc.]\nNetwork Activity: [C2 connections if any]\nHost: [Hostname]\nUser: [Account context]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n",{"name":5,"tags":44,"author":49,"domain":38,"license":15,"version":50,"category":5,"nist_csf":51,"subdomain":45,"description":7,"mitre_attack":56,"d3fend_techniques":62},[45,33,46,32,31,47,48],"threat-hunting","process-hollowing","t1055","proactive-detection","mahipal","1.0",[52,53,54,55],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[57,58,59,60,61],"T1046","T1057","T1082","T1083","T1055",[63,64,65,66,67],"Platform Monitoring","Process Code Segment Verification","Segment Address Offset Randomization","Process Analysis","Application Hardening","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fdetecting-process-hollowing-technique",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill detecting-process-hollowing-technique",{"tool":82,"command":83},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill detecting-process-hollowing-technique",{"tool":85,"command":86},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill detecting-process-hollowing-technique","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",972,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",1162,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",3127,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",3819,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",4564,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",12220,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fdetecting-process-hollowing-technique\u002Fscripts\u002Fprocess.py",[126,156,182,204,220,240],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":137,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[132],{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[138,139,140,141,142,143,38,144,35,145,146,147,148,149,150,151,152,153,154,155],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[163,164,165,166,167,38,168,169,170,171,172,173,174,175,176,177,178,179,180,181],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[189,190,153,38,191,192,193,149,150,29,194,195,196,197,198,199,200,201,202,203],"security","triaging security incident","actions","soc","NIST","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[189,211,212,190,153,167,38,213,192,146,214,215,149,150,216,194,177,217,218,219],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":221,"name":222,"nameZh":6,"description":223,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":224,"categories":225,"keywords":226,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[189,227,228,229,230,231,38,232,233,234,192,235,149,236,237,238,197,28,153,239],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","de",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":246,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[247,248,249,250,38,34,33,251,252,253,254,236,255,256,28,257,239,258,259,260],"infrastructure","tracking threat actor infrastructure","tracking","threat","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]