Back to Security essentials

Process Hollowing

Process hollowing is a sophisticated malware technique where an attacker creates a legitimate process in a suspended state. They then unmap or 'hollow out' the original code from its memory space. Finally, malicious code is injected into this now empty memory region. The process is then resumed, executing the attacker's code under the guise of a trusted application.

Understanding Process Hollowing

This technique is widely used by advanced persistent threats and various malware families to bypass security defenses. By injecting malicious code into a legitimate process, such as svchost.exe or explorer.exe, attackers make it difficult for antivirus software and intrusion detection systems to distinguish between benign and malicious activity. The legitimate process's digital signature and initial execution path often fool security tools. This allows the malware to operate with elevated privileges and persist on a system, making detection and remediation challenging for security analysts. It's a common method for achieving stealth and privilege escalation.

Organizations must implement robust endpoint detection and response EDR solutions to identify process hollowing. Regular security audits and memory forensics are crucial for uncovering such hidden threats. IT security teams are responsible for monitoring process behavior anomalies and ensuring systems are patched against known vulnerabilities that facilitate these attacks. Understanding this technique is strategically important for developing effective defense mechanisms and incident response plans, minimizing the risk of data breaches and system compromise.

How Process Hollowing Processes Identity, Context, and Access Decisions

Process hollowing is a code injection technique where an attacker creates a new process in a suspended state. They then unmap the memory of the legitimate executable that was loaded into this suspended process. Next, the attacker writes their malicious code into the now empty memory space. Finally, they modify the process's entry point to point to the malicious code and resume the process. This allows the malicious code to execute under the guise of a legitimate system process, making it harder to detect by security tools.

This technique is often a critical step in a broader attack chain, enabling malware to achieve persistence or escalate privileges. Effective detection relies on monitoring unusual process creation, memory region modifications, and suspicious API calls. Endpoint Detection and Response EDR solutions are essential for identifying these anomalies. Integrating EDR with security information and event management SIEM systems provides comprehensive visibility. Regular system patching and strong access controls further reduce the attack surface.

Places Process Hollowing Is Commonly Used

Attackers commonly employ process hollowing to execute malicious code discreetly, making it appear as a legitimate system process.

  • Evading antivirus and EDR systems by masquerading as trusted applications.
  • Injecting ransomware or other malware into a benign host process for execution.
  • Maintaining persistence on a compromised system by hiding malicious operations.
  • Escalating privileges by running malicious code within a high-privilege process.
  • Bypassing application whitelisting policies that trust specific executables.

The Biggest Takeaways of Process Hollowing

  • Implement robust EDR solutions to detect unusual process memory modifications and behavioral anomalies.
  • Monitor newly created processes and their parent-child relationships for suspicious activity.
  • Regularly update operating systems and applications to patch known vulnerabilities exploited by attackers.
  • Utilize memory forensics tools to analyze suspicious process memory regions for injected code.

What We Often Get Wrong

Process Hollowing is always easy to detect.

While EDR tools improve detection, sophisticated attackers use advanced obfuscation and anti-analysis techniques. Reliable identification requires deep visibility into process memory and behavior, not just signature-based scanning, making it challenging to always detect.

It only affects old operating systems.

Process hollowing exploits fundamental process creation mechanisms. Modern Windows versions, Linux, and macOS are all susceptible, though specific implementation details may vary. It is not limited to outdated systems.

Antivirus software fully prevents process hollowing.

Traditional antivirus often struggles with process hollowing because it focuses on file-based signatures. The malicious code is injected into a legitimate process's memory, bypassing file scans. Advanced behavioral analysis is needed for effective prevention and detection.

On this page

Related Terms

Unified Access
Lateral Account Compromise
Threat Data
Threat Response Automation
Open Api Security
Secure Cloud Workload
Network Isolation
File Quarantine

Frequently Asked Questions

What is Process Hollowing?

Process Hollowing is a stealthy code injection technique used by malware to hide its malicious activities. It involves creating a legitimate process in a suspended state, emptying its memory space, and then writing malicious code into that hollowed-out memory. The legitimate process's main thread is then resumed, causing it to execute the attacker's code instead of its original program. This makes the malicious code appear to be part of a trusted application.

How does Process Hollowing work?

An attacker first creates a new instance of a legitimate program, like explorer.exe, in a suspended state. Next, they unmap or "hollow out" the legitimate code from the process's memory. Then, the attacker injects their malicious code into the now-empty memory space. Finally, the main thread of the suspended process is resumed, causing it to execute the injected malicious code. This technique allows malware to run under the guise of a trusted process.

Why do attackers use Process Hollowing?

Attackers use Process Hollowing primarily for evasion and persistence. By injecting malicious code into a legitimate process, the malware can bypass security defenses that monitor for new, suspicious processes. It also makes detection more difficult, as the malicious code runs within a trusted process's context, blending in with normal system activity. This technique helps malware maintain a foothold on a system without being easily noticed.

How can Process Hollowing be detected?

Detecting Process Hollowing often involves monitoring process memory and behavior. Security tools look for anomalies such as a legitimate process having its memory unmapped and rewritten, or a process executing code from an unexpected memory region. Behavioral analysis can also flag processes that exhibit unusual network connections or file system access patterns, even if they appear legitimate. Memory forensics and endpoint detection and response (EDR) solutions are key for detection.