MITRE ATT&CKsub-technique

T1055.012 Process Hollowing

Published 2020-01-14 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Stealth, Privilege Escalation
Platforms
Windows
Version
2.0
Created
2020-01-14

Description

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as CreateProcess, which includes a flag to suspend the processes primary thread. At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively. This is very similar to Thread Local Storage but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1055 Process Injection technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1040 Behavior Prevention on Endpoint mitigation

Referenced by MITRE ATT&CK · uses (44)

  • S9050 Vidar software (malware)
  • S9016 Caminho software (malware)
  • S9018 HeartCrypt software (malware)
  • S9012 TRAILBLAZE software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1207 XLoader software (malware)
  • G1043 BlackByte group
  • S1138 Gootloader software (malware)
  • S1130 Raspberry Robin software (malware)
  • S1111 DarkGate software (malware)
  • S1086 Snip3 software (malware)
  • G1018 TA2541 group
  • S1065 Woody RAT software (malware)
  • S1018 Saint Bot software (malware)
  • S0689 WhisperGate software (malware)
  • S0662 RCSession software (malware)
  • S0660 Clambling software (malware)
  • S0650 QakBot software (malware)
  • S0567 Dtrack software (malware)
  • S0534 Bazar software (malware)
  • S0483 IcedID software (malware)
  • S0447 Lokibot software (malware)
  • G0099 APT-C-36 group
  • G0094 Kimsuky group
  • S0386 Ursnif software (malware)
  • S0373 Astaroth software (malware)
  • S0367 Emotet software (malware)
  • S0344 Azorult software (malware)
  • S0354 Denis software (malware)
  • S0331 Agent Tesla software (malware)
Show all 44 ›

Referenced by Compliance · mitigates (7)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-SC-18 Mobile Code NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References