Process execution from remote memory section
Detects execution of a process image originating from a memory section mapped without a backing file, a strong indicator of advanced process injection techniques such as ghostly hollowing. In this pattern, a malicious image is mapped directly into memory, loaded into a remote process, and subsequently executed without ever being written to disk. This allows attackers to evade file-based detection and forensic recovery.
- Platform: Windows
- Severity: High
- MITRE Tactic: Defense Evasion
- MITRE Techniques: T1055