ATT&CK technique
View on MITRE ATT&CK →
T1055.012
Process Hollowing
StealthPrivilege Escalation
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Suspicious Endpoint Security Parent Process | production | 2026-09-18 |
| elastic | Unusual Service Host Child Process - Childless Service | production | 2026-09-18 |
| elastic | Unusual Parent-Child Relationship | production | 2026-09-18 |
| elastic | Suspicious Process Creation CallTrace | production | 2026-09-18 |
| splunk | PowerShell PInvoke Process Injection API Chain | production | 2026-06-25 |
| sigma | Uncommon Svchost Command Line Parameter | experimental | 2026-03-23 |
| sigma | HackTool - HollowReaper Execution | experimental | 2025-07-01 |
| sigma | Potential Pikabot Hollowing Activity | test | 2024-01-26 |
| sigma | Potential Process Hollowing Activity | test | 2023-11-28 |
| sigma | HackTool - CACTUSTORCH Remote Thread Creation | test | 2023-05-05 |