Process hollowing is a concealment method in which a normal program starts and the code in its memory is replaced with other code.
This article stays at that outcome level and does not describe steps, tools, or calls that would carry the method out.
How it works
From the outside, the process still wears the name and sometimes the identity of a trusted program.
Inside, the running contents no longer match the file that was launched, which is why the technique is used to hide.
Defenders look for disagreement between the file on disk and what is executing, and for programs that start without the usual user action.
Naming the idea helps detection teams talk about it without turning the description into a procedure.
Concrete examples
- A help desk tool appears to be running, yet its memory does not match the signed file on disk.
- A monitoring agent starts at logon even though nobody opened that program, and its image looks substituted.
- An investigation finds a familiar process name whose loaded contents belong to a different program.
Protective measures
- Compare running memory with the trusted file on disk and investigate processes that do not match.
- Alert when trusted programs start without the user or service action that normally launches them.
- Limit who can run unexpected programs and prefer application control on sensitive workstations.
- Investigate with a known clean procedure from your incident plan rather than experimenting on the live host.