T1055.012 — Process Hollowing

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. Process hollowing is commonly performed by creating a process in a…

Sub-technique of Process Injection (T1055).

Sigma detection rules (1)

T1055.012 Process Injection: Process Hollowing - Legitimate Binary Spawned by Scripting Engine

title: "T1055.012 Process Injection: Process Hollowing - Legitimate Binary Spawned by Scripting Engine"
id: def4a4f1-b35e-4a38-ba04-5c11f3a4ce87
status: test
description: 'Detects a commonly-hollowed system binary (svchost.exe, explorer.exe, lsass.exe) whose parent process is a scripting engine -- these binaries are never legitimately launched this way, a strong indicator the process was created suspended for hollowing.'
references:
  - https://attack.mitre.org/techniques/T1055/012/
author: Shahrukh Khan
date: 2026-07-10
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1055.012

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
    Image|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
      - '\lsass.exe'

  condition: selection

falsepositives:
  - Software deployment/patching tools that legitimately chain a scripting engine into a system-utility relaunch; verify the parent-child relationship against known deployment tooling before escalating. Process hollowing is difficult to observe conclusively in process-creation telemetry alone; recommend EDR-level kernel callback telemetry (or Sysmon EventID 25 ProcessTampering) for higher-fidelity coverage.

level: high

Related sub-techniques

Explore