Detecting and Mitigating Process Hollowing (T1055.012)

Process hollowing is MITRE ATT&CK T1055.012. It targets Windows and is a sub-technique of Process Injection. The goal MITRE gives is to evade process-based defenses, by running arbitrary code inside a process that looks legitimate.

How attackers use it

The method starts by creating a process in a suspended state. A native call such as CreateProcess has a flag that suspends the primary thread. At that point the process's memory can be unmapped, using calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection. The hollowed space is then filled with new code, execution is realigned to it, and the process is resumed. MITRE lists the supporting calls as VirtualAllocEx, WriteProcessMemory, SetThreadContext and ResumeThread.

Two points set this apart from its neighbors.

First, it creates a new process rather than targeting one that is already running. That is the difference from thread execution hijacking, and MITRE also compares it with TLS callback injection, which can be performed using hollowing.

Second, MITRE says this behavior will likely not give elevated privileges. The new process is spawned by the injector and inherits its security context. So the main value to an adversary here is cover. The process on screen has a trusted name, but the code inside is not what that name implies.

How to detect it

MITRE's detection strategy describes the full chain:

1. A process is created with the CREATE_SUSPENDED flag through CreateProcess.
2. The child's memory is unmapped with NtUnmapViewOfSection.
3. Replacement code is written in with VirtualAllocEx and WriteProcessMemory.
4. SetThreadContext and ResumeThread begin execution inside the hollowed process.

Individual calls are common in legitimate software, so the value is in the order and in the relationship between parent and child. A parent that starts a child suspended, writes into it, and resumes it, all within moments, deserves a look.

Other angles that follow from this:

• A well-known system process launched by an unusual parent.
• A process whose in-memory image does not match the file it was started from.
• A process that starts suspended and is only resumed after memory activity.

Which of these you can see depends on your endpoint telemetry. Process creation logs alone will show the odd parent but not the memory steps.

How to reduce the risk

MITRE lists one mitigation, Behavior Prevention on Endpoint. Some endpoint security solutions can be configured to block certain kinds of process injection based on the common sequences of behavior that occur while it happens. Hollowing has a well-known sequence, so it is a good test of whether your tool actually blocks anything.

In plain steps:

1. Confirm the endpoint agent is installed and in blocking mode on Windows servers and workstations.
2. Check that it reports injection attempts, not only known files.
3. Test against an approved, benign simulation to confirm alerts reach your team.
4. Keep an allow list for tools that legitimately create suspended processes, such as some debuggers and installers, so alerts stay meaningful.

Because the technique is often one step in a longer chain, pair it with controls on how code arrives in the first place. For software dependencies and packages that reach build and developer machines, you can run a free in-browser dependency scan at https://gold.safeguard.sh/scan. It needs no login, the file never leaves your machine, and it covers up to 100 dependencies.

Check your own environment

• Does your endpoint tool log a process created with a suspended primary thread?
• Can you query parent and child process pairs and spot unusual ones, for example a system process with a parent that is not normal for it?
• Do you alert on memory writes into a freshly created child process?
• Who owns the response when one of these alerts fires?

If you answer no to any of these, that is your gap to close first.

Quick check

Sources

• MITRE ATT&CK T1055.012 Process Hollowing