attack.t1055.012

Potential Process Hollowing Activity

Oct 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.012 ·

Detects when a memory process image does not match the disk image, indicative of process hollowing.

HackTool - CACTUSTORCH Remote Thread Creation

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

Potential Pikabot Hollowing Activity

Aug 12, 2024 · attack.defense-evasion attack.t1055.012 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries