← LibraryTechnique entry
INJ-PROCESS-HOLLOWINGDefense Evasion
Process Hollowing (T1055.012)
Spawn a benign process suspended, unmap its image, write attacker PE in place, resume — classic SDV stealth primitive.
§ Where this technique fits
INJ-PROCESS-HOLLOWING is catalogued under the Defense Evasion tactic of the offensive-security kill-chain. It appears in 2 approved dossiers in the registry, typically at step 3 on average.
§ Dossiers chaining this technique
- step 2 / 6
Process hollowing → run beacon in svchost shell
Spawn svchost.exe suspended, unmap its image, write attacker PE into the same address space, resume — the process keeps a legit-looking PEB and command line but executes beacon code.
- step 4 / 6
Process doppelgänging → spawn signed image with attacker bytes
Use NTFS transactional file APIs to overlay an attacker image during process creation. The final mapped process differs from the on-disk file — AV sees only the legit signed image at scan time.
§ What commonly comes next
- 01Command and Scripting Interpreterseen 1×T1059 · Execution
- 02Thread Execution Hijackseen 1×INJ-THREAD-HIJACK · Defense Evasion