title: Process Hollowing (T1055.012)
id: df00tech-t1055-012
status: experimental
description: "Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as CreateProcess (which includes a flag to suspend the processes primary thread). At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively. This is a widely-used technique employed by Cobalt Strike, Emotet, QakBot, and many other threat actors."
references:
  - https://attack.mitre.org/techniques/T1055/012/
  - https://df00tech.com/detections/T1055.012
author: df00tech
date: 2026/04/16
tags:
  - attack.t1055.012
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: process_creation
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - Legitimate COM activation spawning dllhost.exe with minimal arguments
  - Windows Error Reporting spawning WerFault.exe
  - Application installers creating helper processes that appear with minimal command lines
  - Debugging scenarios where processes are started suspended intentionally
level: critical