domains / families / security / detecting-process-hollowing-technique

detecting-process-hollowing-technique

separate

Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped

When to use

• When investigating suspected fileless malware or in-memory threats
• After EDR alerts on process injection or suspicious memory operations
• When hunting for defense evasion techniques in a compromised environment
• When threat intel reports indicate process hollowing in active campaigns
• During purple team exercises validating T1055.012 detection coverage

Skill page

Source