1200KM / detection
T1055.012 Process Hollowing — Detection Rules
Detection workspace for T1055.012 Process Hollowing: 4 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- HackTool - CACTUSTORCH Remote Thread Creation · test · high · {"product":"windows","category":"create_remote_thread"}
- HackTool - HollowReaper Execution · experimental · high · {"category":"process_creation","product":"windows"}
- Uncommon Svchost Command Line Parameter · experimental · high · {"category":"process_creation","product":"windows"}
- Potential Process Hollowing Activity · test · medium · {"product":"windows","category":"process_tampering"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0382 Detection Strategy for Process Hollowing on Windows
AN1076 Analytic 1076
Detects adversary use of suspended process creation, using the CREATE_SUSPENDED flag via CreateProcess, followed by unmapping the memory of the child process (NtUnmapViewOfSection) and replacing it with malicious code via VirtualAllocEx/WriteProcessMemory, then SetThreadContext and ResumeThread to begin execution within the hollowed process.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.