Sigma rule: Potential Process Hollowing Activity

Rule

Title

Potential Process Hollowing Activity

Status

test

Level

medium

Author

Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S

Date

2022-01-25

Modified

2023-11-28

File

rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Log source

product

windows

category

process_tampering

Detection

selection:
    Type: 'Image is replaced'
filter_main_generic:
    Image|contains:
        - ':\Program Files (x86)'
        - ':\Program Files\'
        - ':\Windows\System32\wbem\WMIADAP.exe'
        - ':\Windows\SysWOW64\wbem\WMIADAP.exe'
filter_optional_opera:
    Image|contains: '\AppData\Local\Programs\Opera\'
    Image|endswith: '\opera.exe'
filter_optional_edge:
    Image|endswith: '\WindowsApps\MicrosoftEdge.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055.012

MITRE ATT&CK ids this rule names

• T1055.012

References

• https://twitter.com/SecurePeacock/status/1486054048390332423?s=20
• https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml