Browse Definitions :
Definition

process hollowing

Process hollowing is a security exploit in which an attacker removes code in an executable file and replaces it with malicious code. The process hollowing attack is used by hackers to cause an otherwise legitimate process to execute malicious code. This attack can be done while evading potential defenses, such as detection analysis software.

Process hollowing exploits are often initiated through malicious links in phishing emails. For example, a Windows user could select one of the infected links, leading their computer to execute a PowerShell command. That command could then download and install the attacker's malware.

Similar to other types of code injection attacks, process hollowing can be difficult to detect.

How it works

The malware used will typically allow the attacker to do something to a software program that seems real, like "add a pause during the launch process." During the pause, the attacker can remove legitimate code in the program's executable file and replace it with malicious code. This is referred to as hollowing. When the launch process resumes, it will execute the attacker's code before continuing to run normally. Essentially, process hollowing allows the attacker to turn a legitimate executable file into a malicious container that appears to be trustworthy. This strategy means it's highly likely that the target's antimalware software will not be able to detect there was a swap.

How to deal with process hollowing

It's difficult to prevent process hollowing attacks because they exploit required system processes. It's also difficult to detect process hollowing attacks because the malicious code can delete traces of itself from the disk to avoid being identified. As a result, many security vendors are recommending the use of post-breach strategies to deal with process hollowing. Because of this, a new market segment for this type of advanced persistent threat (APT) is emerging. Research firm Gartner is calling the new market segment "endpoint detection and response (EDR)." EDR focuses on creating tools that detect and investigate suspicious actions and other problems on hosts and endpoints.

This was last updated in April 2020

Continue Reading About process hollowing

Networking
Security
  • security posture

    Security posture refers to an organization's overall cybersecurity strength and how well it can predict, prevent and respond to ...

  • ISO 31000 Risk Management

    The ISO 31000 Risk Management framework is an international standard that provides organizations with guidelines and principles ...

  • voice squatting

    Voice squatting is an attack vector for voice user interfaces, or VUIs, that exploits homonyms -- words that sound the same, but ...

CIO
  • Whistleblower Protection Act

    The Whistleblower Protection Act of 1989 is a law that protects federal government employees in the United States from ...

  • skunkworks project (Skunk Works)

    A skunkworks project, also known as Skunk Works, is an innovative undertaking, involving a small group of people, that is outside...

  • digital innovation

    Digital innovation is the adoption of modern digital technologies by a business.

HRSoftware
  • talent network

    A talent network is a group of interconnected people with similar professional skills.

  • employee onboarding and offboarding

    Employee onboarding involves all the steps needed to get a new employee successfully deployed and productive, while offboarding ...

  • skill-based learning

    Skill-based learning develops students through hands-on practice and real-world application.

Customer Experience
  • virtual assistant (AI assistant)

    A virtual assistant, also called an AI assistant or digital assistant, is an application program that understands natural ...

  • Microsoft Dynamics 365

    Dynamics 365 is a cloud-based portfolio of business applications from Microsoft that are designed to help organizations improve ...

  • Salesforce Commerce Cloud

    Salesforce Commerce Cloud is a cloud-based suite of products that enable e-commerce businesses to set up e-commerce sites, drive ...

Close