Process Hollowing

What It Is

What Changes Inside the Process

The process is shown before and after, and the pointer marks what changed.

What It Leaves Behind

Which Evidence Can See It

Each tile says whether that kind of evidence can see it, and what it shows.

• Memory

  Sees it

  A memory image shows the region at the image base missing, created with the wrong protection, or at a base the PEB and the kernel disagree on.

• EDR Telemetry

  Partly

  DeviceProcessEvents in Defender XDR records the start and its odd parent. Microsoft documents no column there for an image replaced in memory.

• Disk

  Cannot see

  The file on disk is genuine and unchanged, so a hash or signature check passes it. Only a dump of the process, compared with the file, shows the change.

• Logs

  Partly

  Sysmon event 25 in Microsoft-Windows-Sysmon/Operational reports the replaced image, on machines running Sysmon. Event 4688 in the Security log shows only the odd parent.

How to Confirm It

Work through these in order. Each step names the page that shows how.

1. Read its parent and command line from the creation record. A system program started by a user program, or with missing arguments, often comes with it, and where Sysmon runs, event 25 with Type Image is replaced follows.Process Trees and Call Chains
2. In a memory image, read the region at the image base with windows.vadinfo, since a genuine image is mapped from its file. Then windows.malware.hollowprocesses reports a region that is missing, created with a protection other than Execute, write copy, or at a base the PEB and the kernel disagree on.Memory Regions
3. Compare its code with the file live with Windows.Memory.Mem2Disk, which reads only memory mapped from a file. Pair it with Windows.System.VAD, which lists executable memory no file backs.Checking for Injected Code
4. Agree it with whoever runs the response first, then extract the executable from memory with windows.pedump or Windows.Memory.PEDump and compare it with the file. A dump differs from the file where Windows adjusted addresses as it loaded it, so compare its code, not its hash.Dumping a Process and Memory

Investigation Steps With Named Tools

Each question has the tools that answer it on a running machine, and in a memory image, a copy of its memory saved to a file.

• Does the image in memory still match its file on disk?

  On a Running Machine

  • Windows.Memory.HollowsHunter (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. An exchange artifact that runs the third-party hollows_hunter tool to find replaced or implanted modules, and uploads its findings and process dumps. Agree its use first.
  • Defender for Endpoint live response (documentation, opens in a new tab)Live Machine Part of Defender for Endpoint. It opens a command console on one machine from the Defender portal, so you can list its processes from your desk. processes Its processes command finds the process, getfile downloads its file, and an advanced command asks Microsoft's engines for a verdict. No built-in command reads its memory.

  In a Memory Image

  • windows.malware.hollowprocesses (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. Flags a missing or wrongly protected region at the image base, or a PEB image base that differs from the kernel's.

• What is mapped at the image base?

  On a Running Machine

  • Windows.System.VAD (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. VAD means virtual address descriptors, the records of memory regions. The process's memory as Windows reports it now, each region with its mapped file, so the region at the image base shows what it maps.

  In a Memory Image

  • windows.vadinfo (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. vadinfo means virtual address descriptor information. Every region with the protection it was created with and its file, so read the one at the image base.

• Which program started it?

  On a Running Machine

  • DeviceProcessEvents (documentation, opens in a new tab)Logs and Records A Defender XDR table. It holds the records Defender for Endpoint keeps of what happened on each machine, and you search it with KQL. The creation record, with InitiatingProcessFileName and ProcessCommandLine, kept after the parent exits.

  In a Memory Image

  • windows.pstree (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pstree means process tree. Each process under its parent, so a service host under a program from Downloads stands out.

What Defenders See

Each record names its log and what must be switched on to get it.

False Positives

SigmaHQ's rule leaves out programs under Program Files, WMIADAP.exe and two browsers, so expect Sysmon event 25 from software like them. Review those events against what is installed instead of dropping them.

Blind Spots

windows.malware.hollowprocesses skips processes with fewer than three DLLs or five memory regions, treating them as exited or garbled in the capture, so check those by hand.

Only a process alive at capture still has its memory in an image. One that has already exited survives only in creation records and Sysmon event 25.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

// Core Windows hosts started by a program in a user, temporary or ProgramData folderDeviceProcessEvents| where Timestamp > ago(30d)| where FileName in~ ("svchost.exe", "dllhost.exe", "RuntimeBroker.exe", "taskhostw.exe", "sihost.exe", "spoolsv.exe", "lsass.exe", "services.exe")| where InitiatingProcessFolderPath has_any ("Users", "Temp", "ProgramData")| summarize Starts = count(), Devices = dcount(DeviceId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)    by FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath| order by Devices asc, Starts asc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

• windows.malware.hollowprocesses (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. It compares the PEB's image base with the kernel's, and checks that a region at the executable's base was created as Execute, write copy, as images are. It checks the same protection for each DLL in the load order list.
• windows.malware.ldrmodules (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. ldrmodules means loader modules. It sets every region that starts with an MZ header, private memory included, against the PEB's three loader lists. A region no list names is a lead, since the executable and resource files miss lists for ordinary reasons.
• windows.vadinfo (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. vadinfo means virtual address descriptor information. It lists each region with the protection it was created with and its file. In a hollowed process no region starts at the image base, or the one there was created with another protection or names no file.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

How to Prevent It

Each control helps prevent it, and its line says what it does here.

• App Control for Business (opens in a new tab) Let only trusted code run, so the program that starts and hollows a process is refused first.
• ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (opens in a new tab) Block executables that are new, rare or untrusted, such as a downloaded program that starts a service host.
• Sysmon (opens in a new tab) Run Sysmon with process tampering events on, so a replaced image leaves event 25.

Related

Travels with

• Wrong Parent A hollowed process is often started by a program that never starts it, the easiest part to see in a tree.
• Odd Command Lines A service host with no arguments, which SigmaHQ's rule reads as a likely injection target, shows as an odd command line.

Sources

• Microsoft Learn: Sysmon, event ID 25 ProcessTampering (opens in a new tab)
• Microsoft Learn: Live response in Defender for Endpoint (opens in a new tab)
• SigmaHQ: Potential Process Hollowing Activity (opens in a new tab)
• Volatility 3: windows.malware.hollowprocesses (opens in a new tab)
• Velociraptor: Windows.Memory.HollowsHunter (opens in a new tab)
• Velociraptor: Windows.Memory.Mem2Disk (opens in a new tab)
• Elastic: Unusual Parent-Child Relationship (opens in a new tab)