Process hollowing → run beacon in svchost shell

§ Context

Assumed environment: foothold as a user or service account on Windows. EDR/AV is signature-only or doesn't yet detect manual map / Hell's-gate-style flow.

§ Steps

1. 01
   Foothold shellInitial Access

   T1078— Valid Accounts
2. 02
   Beacon under svchost.exe identityCommand and Control

   T1071— Application Layer Protocol
3. 03
   WriteProcessMemory attacker PEDefense Evasion

   INJ-PROCESS-HOLLOWING— Process Hollowing (T1055.012)
4. 04
   NtUnmapViewOfSection on the loaded imageDefense Evasion

   INJ-PROCESS-HOLLOWING— Process Hollowing (T1055.012)
5. 05
   CreateProcess svchost.exe SUSPENDEDDefense Evasion

   INJ-PROCESS-HOLLOWING— Process Hollowing (T1055.012)
6. 06
   SetThreadContext + ResumeThreadDefense Evasion

   INJ-THREAD-HIJACK— Thread Execution Hijack

§ References

• T1078Valid Accounts
• T1071Application Layer Protocol

§ Frequently asked

What is the "Process hollowing → run beacon in svchost shell" attack path?

Spawn svchost.exe suspended, unmap its image, write attacker PE into the same address space, resume — the process keeps a legit-looking PEB and command line but executes beacon code. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Foothold shell (T1078) — a initial access primitive. Assumed environment: foothold as a user or service account on Windows.

What is the final impact of this kill-chain?

The final step lands on SetThreadContext + ResumeThread (INJ-THREAD-HIJACK), which falls under Defense Evasion. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Build-system implant → signed supply-chain backdoor (SolarWinds-class)

  Compromise the target vendor's build server. A small implant rewrites a single source file at compile time — every official signed release downstream now ships the backdoor.

• Shared techniques2

  AMSI patch → in-memory .NET / PowerShell stager

  Patch AmsiScanBuffer in amsi.dll → return clean for any content. Subsequent PowerShell / Office VBA / .NET runtime calls emit attacker code without scanning.

• Shared techniques2

  Process doppelgänging → spawn signed image with attacker bytes

  Use NTFS transactional file APIs to overlay an attacker image during process creation. The final mapped process differs from the on-disk file — AV sees only the legit signed image at scan time.

• Shared techniques2

  certutil + bitsadmin → AV-friendly stager chain

  Initial access dropped a tiny .bat. It uses certutil to decode a base64 blob and bitsadmin to fetch the real beacon, then schtasks for persistence. Every binary is signed Microsoft.

• Shared techniques2

  Autodiscover external leak → credential harvest

  Mis-implemented Autodiscover falls back to autodiscover.<TLD>; register that domain externally, harvest plaintext Basic-auth credentials from clients that haven't been patched / configured properly.