Detecting Process Hollowing: Suspended Starts and Remote Memory Writes

Process hollowing starts a legitimate executable suspended, removes or overwrites its image in memory, writes the attacker’s payload, redirects the main thread and resumes. On disk the process looks genuine; in memory it is not. Detection works best where you can see the sequence of calls, and falls back on structural anomalies when you cannot.

Signals at a Glance

The API Sequence

The giveaway is the order of operations performed on a process the actor has only just created. Endpoint products that expose cross-process API calls let you join them. In Defender XDR:

// Microsoft Defender XDR (KQL) - hollowing sequence by one initiator against one victim
let window = 2m;
DeviceEvents
| where ActionType in ("NtAllocateVirtualMemoryRemoteApiCall",
                       "NtMapViewOfSectionRemoteApiCall",
                       "SetThreadContextRemoteApiCall",
                       "QueueUserApcRemoteApiCall")
| summarize actions = make_set(ActionType), n = dcount(ActionType),
            first = min(Timestamp)
          by DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessFileName,
             FileName, ProcessId
| where n >= 2 and actions has "SetThreadContextRemoteApiCall"
| project first, DeviceName, InitiatingProcessFileName, FileName, actions
// tune/validate: debuggers, some installers and AV self-tests behave the same way.

Without API telemetry, rely on what a hollowed process looks like from the outside. Windows services run svchost.exe with -k and are started by services.exe; a hollowed copy often lacks both.

title: Suspicious svchost Parent or Missing -k
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\svchost.exe'
  filter_parent:
    ParentImage|endswith:
      - '\services.exe'
      - '\MsMpEng.exe'
      - '\svchost.exe'
  filter_args:
    CommandLine|contains: ' -k '
  condition: selection and not (filter_parent or filter_args)
level: high
# tune/validate: confirm on your build which system binaries start svchost directly.

Memory and Structure

• Enable Sysmon Event 25 (ProcessTampering); hollowing and related image-replacement tricks report there when the in-memory image diverges from the file.
• Scan newly created processes for an executable image-type region whose content differs from the mapped file, or a private executable region at the image base.
• Check the thread start address: after hollowing, the entry point often lies outside the on-disk image’s expected range.
• Hunt rarely-injected hosts: Notepad, calc, RuntimeBroker or werfault with outbound network connections are a classic hollowing outcome (T1055.012).