{"id":"c4b890e5-8d8c-4496-8c66-c805753817cd","title":"Potential Process Hollowing Activity","description":"Detects when a memory process image does not match the disk image, indicative of process hollowing.","author":"Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S","status":"test","level":"medium","date":"2022-01-25","modified":"2023-11-28","tags":["attack.privilege-escalation","attack.stealth","attack.t1055.012"],"technique_ids":["T1055.012"],"logsource":{"product":"windows","category":"process_tampering"},"falsepositives":["Unknown"],"references":["https://twitter.com/SecurePeacock/status/1486054048390332423?s=20","https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/"],"source_path":"rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml","source_sha256":"4b38bcd283a0445d82502d652dc1e5ceaa0ff5a31616cae5a60b9dee5f529397","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Process Hollowing Activity\nid: c4b890e5-8d8c-4496-8c66-c805753817cd\nstatus: test\ndescription: Detects when a memory process image does not match the disk image, indicative of process hollowing.\nreferences:\n    - https://twitter.com/SecurePeacock/status/1486054048390332423?s=20\n    - https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/\nauthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S\ndate: 2022-01-25\nmodified: 2023-11-28\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1055.012\nlogsource:\n    product: windows\n    category: process_tampering\ndetection:\n    selection:\n        Type: 'Image is replaced'\n    filter_main_generic:\n        Image|contains:\n            - ':\\Program Files (x86)'\n            - ':\\Program Files\\'\n            - ':\\Windows\\System32\\wbem\\WMIADAP.exe'\n            - ':\\Windows\\SysWOW64\\wbem\\WMIADAP.exe'\n    filter_optional_opera:\n        Image|contains: '\\AppData\\Local\\Programs\\Opera\\'\n        Image|endswith: '\\opera.exe'\n    filter_optional_edge:\n        Image|endswith: '\\WindowsApps\\MicrosoftEdge.exe'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055.012","id":"T1055.012","name":"Process Hollowing","page":"techniques/enterprise/T1055.012/"}],"data_path":"data/detection-rules/c4b890e5-8d8c-4496-8c66-c805753817cd.json","kind":"sigma"}