Browse Definitions :
Definition

process hollowing

Process hollowing is a security exploit in which an attacker removes code in an executable file and replaces it with malicious code. The process hollowing attack is used by hackers to cause an otherwise legitimate process to execute malicious code. This attack can be done while evading potential defenses, such as detection analysis software.

Process hollowing exploits are often initiated through malicious links in phishing emails. For example, a Windows user could select one of the infected links, leading their computer to execute a PowerShell command. That command could then download and install the attacker's malware.

Similar to other types of code injection attacks, process hollowing can be difficult to detect.

How it works

The malware used will typically allow the attacker to do something to a software program that seems real, like "add a pause during the launch process." During the pause, the attacker can remove legitimate code in the program's executable file and replace it with malicious code. This is referred to as hollowing. When the launch process resumes, it will execute the attacker's code before continuing to run normally. Essentially, process hollowing allows the attacker to turn a legitimate executable file into a malicious container that appears to be trustworthy. This strategy means it's highly likely that the target's antimalware software will not be able to detect there was a swap.

How to deal with process hollowing

It's difficult to prevent process hollowing attacks because they exploit required system processes. It's also difficult to detect process hollowing attacks because the malicious code can delete traces of itself from the disk to avoid being identified. As a result, many security vendors are recommending the use of post-breach strategies to deal with process hollowing. Because of this, a new market segment for this type of advanced persistent threat (APT) is emerging. Research firm Gartner is calling the new market segment "endpoint detection and response (EDR)." EDR focuses on creating tools that detect and investigate suspicious actions and other problems on hosts and endpoints.

This was last updated in April 2020

Continue Reading About process hollowing

SearchCompliance
  • OPSEC (operations security)

    OPSEC (operations security) is a security and risk management process and strategy that classifies information, then determines ...

  • smart contract

    A smart contract is a decentralized application that executes business logic in response to events.

  • compliance risk

    Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting ...

SearchSecurity
SearchHealthIT
SearchDisasterRecovery
  • What is risk mitigation?

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • change control

    Change control is a systematic approach to managing all changes made to a product or system.

  • disaster recovery (DR)

    Disaster recovery (DR) is an organization's ability to respond to and recover from an event that affects business operations.

SearchStorage
  • secondary storage

    Secondary storage is persistent storage for noncritical data that doesn't need to be accessed as frequently as data in primary ...

  • optical storage

    Optical storage is any storage type in which data is written and read with a laser.

  • JBOD (just a bunch of disks)

    JBOD, which stands for 'just a bunch of disks,' is a type of multilevel configuration for disks.

Close