T1055.013 — Process Doppelgänging

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process. Windows Transactional NTFS…

Sub-technique of Process Injection (T1055).

Sigma detection rules (1)

T1055.013 Process Injection: Process Doppelgänging

title: "T1055.013 Process Injection: Process Doppelgänging"
id: ea71ccb1-9af0-4dbc-968a-edbd346dfe7a
description: 'Detection Strategy for Process Doppelganging on Windows via Sysmon EventID 25 (ProcessTampering), which fires when a process image on disk is modified/replaced after being mapped into memory. Sysmon does not distinguish Process Doppelganging from Process Herpaderping at the TxF-API level, so this rule is a shared image-tampering signal for both, retargeted from unobservable in-process TxF API names to real Sysmon telemetry. Tune using: TransactionExecutableNamePattern, TimeWindow_TransactionToExecution, ThreadStartEntropyThreshold, TxF API Call Frequency Threshold.'
references:
  - https://attack.mitre.org/techniques/T1055/013
author: Shahrukh Khan
date: 2026-06-07
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1055.013

logsource:
  category: process_tampering
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '25'

  condition: selection

falsepositives:
  - Sysmon EventID 25 also fires for Process Herpaderping and some legitimate software-protection/packer self-modifying loaders; this event carries no TxF-transaction-specific fields, so corroborate with EDR-level kernel callback data where available.

level: high

Related sub-techniques

Explore