Detectionmediumtest

Potential Process Hollowing Activity

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Christopher Peacock, SCYTHE, Sittikorn SCreated Tue Jan 25Updated Tue Nov 28c4b890e5-8d8c-4496-8c66-c805753817cdwindows

Log Source

Windowsprocess_tampering

ProductWindows← raw: windows

Categoryprocess_tampering← raw: process_tampering

Detection Logic

detection:
    selection:
        Type: 'Image is replaced'
    filter_main_generic:
        Image|contains:
            - ':\Program Files (x86)'
            - ':\Program Files\'
            - ':\Windows\System32\wbem\WMIADAP.exe'
            - ':\Windows\SysWOW64\wbem\WMIADAP.exe'
    filter_optional_opera:
        Image|contains: '\AppData\Local\Programs\Opera\'
        Image|endswith: '\opera.exe'
    filter_optional_edge:
        Image|endswith: '\WindowsApps\MicrosoftEdge.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*