Browse Definitions :
Definition

process hollowing

Contributor(s): Wesley Chai; Matthew Haughn

Process hollowing is a security exploit in which an attacker removes code in an executable file and replaces it with malicious code. The process hollowing attack is used by hackers to cause an otherwise legitimate process to execute malicious code. This attack can be done while evading potential defenses, such as detection analysis software.

Process hollowing exploits are often initiated through malicious links in phishing emails. For example, a Windows user could select one of the infected links, leading their computer to execute a PowerShell command. That command could then download and install the attacker's malware.

Similar to other types of code injection attacks, process hollowing can be difficult to detect.

How it works

The malware used will typically allow the attacker to do something to a software program that seems real, like "add a pause during the launch process." During the pause, the attacker can remove legitimate code in the program's executable file and replace it with malicious code. This is referred to as hollowing. When the launch process resumes, it will execute the attacker's code before continuing to run normally. Essentially, process hollowing allows the attacker to turn a legitimate executable file into a malicious container that appears to be trustworthy. This strategy means it's highly likely that the target's antimalware software will not be able to detect there was a swap.

How to deal with process hollowing

It's difficult to prevent process hollowing attacks because they exploit required system processes. It's also difficult to detect process hollowing attacks because the malicious code can delete traces of itself from the disk to avoid being identified. As a result, many security vendors are recommending the use of post-breach strategies to deal with process hollowing. Because of this, a new market segment for this type of advanced persistent threat (APT) is emerging. Research firm Gartner is calling the new market segment "endpoint detection and response (EDR)." EDR focuses on creating tools that detect and investigate suspicious actions and other problems on hosts and endpoints.

This was last updated in April 2020

Continue Reading About process hollowing

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

File Extensions and File Formats

SearchCompliance

  • PCI DSS (Payment Card Industry Data Security Standard)

    The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to ...

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance framework

    A compliance framework is a structured set of guidelines that details an organization's processes for maintaining accordance with...

SearchSecurity

  • DNS over HTTPS (DoH)

    DNS over HTTPS (DoH) is a relatively new protocol that encrypts domain name system traffic by passing DNS queries through a ...

  • integrated risk management (IRM)

    Integrated risk management (IRM) is an approach to risk management that uses a set of practices and processes to improve an ...

  • MITRE ATT&CK framework

    The MITRE ATT&CK (pronounced 'miter attack') framework is a free, globally accessible service that provides comprehensive and ...

SearchHealthIT

  • telemedicine (telehealth)

    Telemedicine is the remote delivery of healthcare services, such as health assessments or consultations, over the ...

  • Project Nightingale

    Project Nightingale is a controversial partnership between Google and Ascension, the second largest health system in the United ...

  • medical practice management (MPM) software

    Medical practice management (MPM) software is a collection of computerized services used by healthcare professionals and ...

SearchDisasterRecovery

SearchStorage

  • M.2 SSD

    An M.2 SSD is a solid-state drive (SSD) that conforms to a computer industry specification and is used in internally mounted ...

  • kilobyte (KB or Kbyte)

    A kilobyte (KB or Kbyte) is a unit of measurement for computer memory or data storage used by mathematics and computer science ...

  • virtual memory

    Virtual memory is a memory management capability of an operating system (OS) that uses hardware and software to allow a computer ...

Close