attack.t1055.012

HackTool - CACTUSTORCH Remote Thread Creation

Apr 28, 2026 · attack.privilege-escalation attack.execution attack.stealth attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·

Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

HackTool - HollowReaper Execution

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1055.012 ·

Share on:

Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.

Potential Pikabot Hollowing Activity

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1055.012 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Potential Process Hollowing Activity

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1055.012 ·

Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Uncommon Svchost Command Line Parameter

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1036.005 attack.t1055 attack.t1055.012 ·

Share on:

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.