Detecting Process Herpaderping, Doppelganging and Ghosting

Herpaderping, doppelganging and ghosting abuse the gap between creating an image section and the security callback that inspects the backing file. The attacker maps a payload into a section, then changes, deletes or transacts away the file before scanners read it. The process runs the payload while the file on disk shows something harmless, or nothing at all.

Signals at a Glance

Sysmon ProcessTampering

Sysmon Event ID 25 exists for exactly this class of attack. It reports a process whose image has been replaced or is locked for access, with a Type field naming the condition. The event is rare on a healthy host, so collect it in full:

<!-- Sysmon configuration fragment: keep every ProcessTampering event -->
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <RuleGroup name="tamper" groupRelation="or">
      <ProcessTampering onmatch="exclude">
        <!-- tune/validate: add only reviewed, well-understood benign images -->
        <Image condition="is">C:\Windows\System32\wbem\WmiPrvSE.exe</Image>
      </ProcessTampering>
    </RuleGroup>
  </EventFiltering>
</Sysmon>
<!-- With onmatch="exclude" and a short list, everything else is logged. -->

Treat every Image is replaced and Image is locked for access event as a ticket until proven benign. Some packers and installers can trigger the first; very few legitimate programs trigger the second.

Image and Hash Consistency

When Sysmon 25 is not available, compare what the process was started from with what exists on disk. A process whose image file is missing, zero length or hashes differently from a prior sighting is a strong lead:

// Microsoft Defender XDR (KQL) - process started but its image is gone or unreadable
DeviceProcessEvents
| where Timestamp > ago(1d)
| where isempty(SHA256) or isempty(FolderPath)
| where not(FileName in~ ("MemCompression", "Registry", "System"))
| join kind=leftanti (
    DeviceFileEvents
    | where ActionType == "FileCreated"
    | project DeviceId, FolderPath, FileName
  ) on DeviceId, FolderPath, FileName
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine,
          InitiatingProcessFileName
// tune/validate: protected and system processes legitimately have no hash.

• Alert on a short chain: file created, section mapped, file overwritten or deleted, then a process created from that section.
• Log executables that are deleted within seconds of the process starting from them; ghosting depends on a delete-pending state.
• Prefer detections tied to process start rather than file scanning, because the file is the part the attacker controls.
• Verify your EDR documents handling for these cases; vendors differ on whether they hook at image-load or at section creation.