skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-process-hollowing-technique

Detect process hollowing by analyzing memory sections, EDR telemetry, and parent-child process anomalies.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#sysmon#edr#memory forensics#process injection#process hollowing#t1055.012
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-process-hollowing-technique
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-process-hollowing-technique
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-process-hollowing-technique
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-process-hollowing-technique

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Process hollowing (MITRE ATT&CK T1055.012) lets malware hide inside legitimate-looking processes like svchost.exe, evading signature-based detection. This Skill gives threat hunters a structured methodology to identify hollowed processes using EDR telemetry, Sysmon events, and memory forensics before attackers establish persistence or C2 channels.

Core Features & Use Cases

  • Sysmon Event Correlation: Stitch Event IDs 1, 8, 10, and 25 to reconstruct the suspended-create, unmap, write, and resume hollowing chain.
  • Image Mismatch Detection: Compare in-memory process images against on-disk binaries to flag hollowed svchost.exe, explorer.exe, or rundll32.exe instances.
  • Evasion Awareness: Accounts for process doppelgänging, process ghosting, and module stomping that bypass standard ProcessTampering alerts, with fallback to pe-sieve, Hollows Hunter, and Volatility.
  • Use Case: After an EDR alert on suspicious memory operations, follow the workflow to confirm hollowing, correlate with network C2 activity, and produce a structured hunt report with risk rating.

Quick Start

Hunt for process hollowing on endpoints that triggered memory injection alerts and report any hollowed processes with their parent processes and network activity.

Frequently Asked Questions about detecting-process-hollowing-technique

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect process hollowing with Sysmon?▼

Detect process hollowing by correlating Sysmon Event ID 1 (process create), Event ID 8 (CreateRemoteThread), and Event ID 10 (ProcessAccess with PROCESS_VM_WRITE) on the same target PID. Event ID 25 ProcessTampering on Sysmon 13+ directly flags image and memory section divergence.

What tools detect hollowed processes in memory?▼

pe-sieve and Hollows Hunter scan live process memory for hollowed images, while Volatility's malfind plugin works on memory dumps. EDR platforms like CrowdStrike Falcon and Microsoft Defender for Endpoint provide built-in ProcessTampering and memory protection alerts.

Why does Sysmon not log process hollowing events?▼

Event ID 25 ProcessTampering requires Sysmon version 13 or later; older agents silently miss hollowing events. Additionally, process doppelgänging and process ghosting bypass EID 25 entirely, requiring memory scanners like pe-sieve or Moneta as fallback.

How do I reduce false positives when hunting process injection?▼

Exclude by signed SourceImage and known security tooling rather than by target process name. Debuggers, antivirus, EDR agents, and installers legitimately perform cross-process memory writes, so tuning must focus on the source process, not the target.

Can process hollowing be validated in a lab environment?▼

Yes, run Atomic Red Team test T1055.012 or a known RunPE proof-of-concept and confirm that Event ID 25 plus the Event ID 8 and 10 correlation fire in your SIEM. This validates detection coverage before relying on it in production hunts.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
YukiIto1999YukiIto1999

analyzing-memory-dumps-with-volatility

Analyze Windows RAM memory dumps with Volatility 3 to detect malware artifacts and indicators of compromise.

Community
Advanced
dandyedandye
120

hunt-threat

Conduct hypothesis-driven threat hunts across SIEM and telemetry sources with GTI enrichment.

Community
Advanced
PriyanshKuniyalPriyanshKuniyal

memory-forensics

Extract and analyze artifacts from memory captures using Volatility Framework.

Community
Advanced