Process creation from a stomped module

Identifies the creation of the process from the parent where the call stack exhibits suspicious memory properties. The pattern is typical of stomped module techniques such as DLL-hollowing or other forms of in-memory code injection where an attacker overwrites or maps shellcode into legitimate system modules to hide malicious payloads.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055

Volver a todas las reglas