Skip to content

Process Hollowing

Subtechnique · ATTACK:enterprise:T1055.012

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1055.012",
  "title": "Process Hollowing",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1055/012",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4",
  "external_id": "T1055.012",
  "domain": "enterprise",
  "created": "2020-01-14T17:21:54.470Z",
  "modified": "2026-09-11T19:54:27.078Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Elastic Process Injection July 2017",
      "url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
    },
    {
      "source_name": "Leitch Hollowing",
      "url": "https://new.dc414.org/wp-content/uploads/2011/01/Process-Hollowing.pdf"
    }
  ]
}

Explicit source assertions (46)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01c3b4b5-a4db-415b-8628-98491f799a0a

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07e8c425-2d17-48ea-98ca-40a2aac8cc10

Unit 42 Gorgon Group Aug 2018

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1094b816-3db3-40a6-9b86-6a4323d4818f

DFIR_Quantum_Ransomware

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1407049c-d3a1-4539-8885-e11cfe08cd99

ANY.RUN XLoader 2023 · Google XLoader 2017 · Zscaler XLoader 2025

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17af5c1a-7912-40af-b7b9-f68f0a15977d

Securelist LuckyMouse June 2018 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bd9ad06-bb44-423c-b670-65b8a8510e1e

Secureworks BRONZE PRESIDENT December 2019 · Profero APT27 December 2020 · Trend Micro DRBControl February 2020

ATTACK:enterprise:T1055.012 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d79747d-3ff5-44ab-ae40-80823347c7d7

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e285f16-a145-46f5-aad3-0ea33392f147

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fdf1686-f498-460a-8948-a5ca46f52b62

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--202ed36b-9052-4464-b6a0-34258ba7a9ab

Unit42 Azorult Nov 2018

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25fc21a1-4965-4c18-9415-215390eab16c

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28139c5b-be96-44d2-8e54-425311d108d6

Cymmetria Patchwork

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30e18b95-a311-4ab5-aa59-a31a20f65f66

ATT QakBot April 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--315cd644-875d-4761-b440-f2cf48badbe0

Cobalt Strike TTPs Dec 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S9018 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33786d33-6b8e-4668-bc63-352152214685

Palo Alto HeartCrypt DEC 2024

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33a464ab-cc0d-436d-9bcd-9d6e08994370

Infoblox Lokibot January 2019 · Talos Lokibot Jan 2021

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--372642cf-1598-46a0-a791-2f6d2d2d8987

Telefonica Snip3 December 2021 · Morphisec Snip3 May 2021

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cc0af18-2897-4008-a2b0-0234df50acde

Lookout Dark Caracal Jan 2018 · EFF Manul Aug 2016 · CheckPoint Bandook Nov 2020

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e7ca7c1-39f9-4549-8446-0610f8c0c1ea

Qualys LummaStealer 2024

ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--517962ee-edee-4193-a67a-d0c372950d66

Zscaler BlindEagle DEC 2025

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cacb853-971b-4bde-8719-dd300fe5aac4

Microsoft BlackByte 2023

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71db7381-ad59-4eb0-80b4-505c38eea9d2

TrendMicro RaspberryRobin 2022

ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72cf04c6-5e0b-4743-9386-88f1f1f45899

Malwarebytes SmokeLoader 2016 · Microsoft Dofoil 2018

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87a90347-6f15-461c-a44c-9acf503a606b

Cybereason Astaroth Feb 2019 · Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8906c905-87ff-48bf-b17e-1b8397ef062e

Securelist Dtrack

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b289eb7-6960-45c4-bea8-bbd9ace81055

Cisco Operation Layover September 2021

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d53b4b9-999a-48e9-b90f-0030bbdae18d

Cisco Ukraine Wipers January 2022 · RecordedFuture WhisperGate Jan 2022

ATTACK:enterprise:S9012 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a418c81f-ab70-4d04-88f5-c1f49d0eceb4

Google UNC5221 Ivanti April 2025 · Picus Security UNC5221 Ivanti May 2025

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5b4d08c-963a-48fe-8f22-ba344835d00e

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a821988a-269f-452b-ab59-5cbb3357f2f6

Trend Micro DRBControl February 2020

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abf48d17-9624-4ea7-be2f-769711609eba

SentinelOne Gootloader June 2021 · Sophos Gootloader

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad7592fd-f5d3-4802-9217-dffe89a6c8eb

Accenture Hogfish April 2018

ATTACK:enterprise:S0189 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1df64c9-782d-4452-8c4a-5ef933503c13

OilRig New Delivery Oct 2017

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b58eb56c-9992-4fcd-ae4f-b7a1301667f0

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7e049fb-ac90-4e93-8907-eca54ba04ebd

Red Canary NETWIRE January 2020 · FireEye NETWIRE March 2019

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dddf6fd0-6d38-4f33-90dc-42ff99c5072b

emotet_trendmicro_mar2023

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddee8f55-feed-4474-b996-b80bbe5209a4

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0229 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e039e3d4-2e3d-4e6e-902e-5e1834abe8e4

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0ce4a5f-ac3b-4d61-b540-c5c3c434beb0

S2 Grupo TrickBot June 2017 · Trend Micro Totbrick Oct 2016 · Microsoft Totbrick Oct 2017 · Cyberreason Anchor December 2019

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1ba1028-0125-4f0e-8ccd-9273deac9d18

FireEye Ursnif Nov 2017

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5bfb355-b834-48db-8d79-9067127ed82b

Talos Kimsuky Nov 2021

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea187577-25ce-458f-a26b-9ee71d3879fd

Cybereason Bazar July 2020 · NCC Group Team9 June 2020

ATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec6074e4-4137-42a4-86c8-1ea95ce54df6

Palo Alto Networks BBSRAT

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f64acb43-91b8-431a-ad0a-ad22afe5851a

Symantec W32.Duqu

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6947e72-9277-4896-b7cd-9dece3503980

Kaspersky BlindEagle AUG 2024

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd507797-cc28-4271-9a4c-d1fbe726722b

Ensilo Darkgate 2018 · Rapid7 BlackBasta 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.