Process creation from a stomped module

Identifies the creation of the process from the parent where the call stack exhibits suspicious memory properties. The pattern is typical of stomped module techniques such as DLL-hollowing or other forms of in-memory code injection where an attacker overwrites or maps shellcode into legitimate system modules to hide malicious payloads.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055

Back to all rules