Process Hollowing
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as <code>CreateProcess</code>, which ...
BY SOURCE
PROCEDURES (8)
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for hollow
Auto-extracted: 1 detections for hollow
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for unusual