Esc
Process Hollowing - T1055.012
(ATT&CK® Technique)
Definition
No definition available.
D3FEND Inferred Relationships
Browse the D3FEND knowledge graph by clicking on the nodes below.
graph LR; T1055012["Process Hollowing"] --> |modifies| ProcessCodeSegment["Process Code Segment"]; class T1055012 OffensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment"; click T1055012 href "/offensive-technique/attack/T1055.012/"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment"; MemoryBoundaryTracking["Memory Boundary Tracking"] --> | analyzes | ProcessCodeSegment["Process Code Segment"]; MemoryBoundaryTracking["Memory Boundary Tracking"] -.-> | May Detect | T1055012["Process Hollowing"] ; class MemoryBoundaryTracking DefensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click MemoryBoundaryTracking href "/technique/d3f:MemoryBoundaryTracking"; SegmentAddressOffsetRandomization["Segment Address Offset Randomization"] --> | obfuscates | ProcessCodeSegment["Process Code Segment"]; SegmentAddressOffsetRandomization["Segment Address Offset Randomization"] -.-> | May Harden | T1055012["Process Hollowing"] ; class SegmentAddressOffsetRandomization DefensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click SegmentAddressOffsetRandomization href "/technique/d3f:SegmentAddressOffsetRandomization"; ProcessSegmentExecutionPrevention["Process Segment Execution Prevention"] --> | neutralizes | ProcessCodeSegment["Process Code Segment"]; ProcessSegmentExecutionPrevention["Process Segment Execution Prevention"] -.-> | May Harden | T1055012["Process Hollowing"] ; class ProcessSegmentExecutionPrevention DefensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click ProcessSegmentExecutionPrevention href "/technique/d3f:ProcessSegmentExecutionPrevention"; ProcessCodeSegmentVerification["Process Code Segment Verification"] --> | verifies | ProcessCodeSegment["Process Code Segment"]; ProcessCodeSegmentVerification["Process Code Segment Verification"] -.-> | May Detect | T1055012["Process Hollowing"] ; class ProcessCodeSegmentVerification DefensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click ProcessCodeSegmentVerification href "/technique/d3f:ProcessCodeSegmentVerification";