Process execution from remote memory section
Detects execution of a process image originating from a memory section mapped without a backing file, a strong indicator of advanced process injection techniques such as ghostly hollowing. In this pattern, a malicious image is mapped directly into memory, loaded into a remote process, and subsequently executed without ever being written to disk. This allows attackers to evade file-based detection and forensic recovery.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Evasión de defensas
- Técnicas MITRE: T1055