mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
80 lines
3.1 KiB
Markdown
80 lines
3.1 KiB
Markdown
# Standards and References - Process Hollowing Detection
|
|
|
|
## MITRE ATT&CK Mappings
|
|
|
|
### T1055.012 - Process Injection: Process Hollowing
|
|
- **Tactic**: Defense Evasion (TA0005), Privilege Escalation (TA0004)
|
|
- **Platforms**: Windows
|
|
- **Data Sources**: Process modification, OS API execution, Process access
|
|
|
|
### Related Process Injection Sub-Techniques
|
|
| Sub-Technique | Name |
|
|
|---------------|------|
|
|
| T1055.001 | Dynamic-link Library Injection |
|
|
| T1055.002 | Portable Executable Injection |
|
|
| T1055.003 | Thread Execution Hijacking |
|
|
| T1055.004 | Asynchronous Procedure Call |
|
|
| T1055.005 | Thread Local Storage |
|
|
| T1055.008 | Ptrace System Calls |
|
|
| T1055.009 | Proc Memory |
|
|
| T1055.011 | Extra Window Memory Injection |
|
|
| T1055.012 | Process Hollowing |
|
|
| T1055.013 | Process Doppelganging |
|
|
| T1055.014 | VDSO Hijacking |
|
|
| T1055.015 | ListPlanting |
|
|
|
|
## Process Hollowing API Call Sequence
|
|
|
|
```
|
|
1. CreateProcess(CREATE_SUSPENDED) -> Create target in suspended state
|
|
2. NtQueryInformationProcess -> Get PEB address
|
|
3. ReadProcessMemory(PEB) -> Read image base from PEB
|
|
4. NtUnmapViewOfSection(ImageBase) -> Unmap original image
|
|
5. VirtualAllocEx(ImageBase, size) -> Allocate memory at same base
|
|
6. WriteProcessMemory(PE headers) -> Write malicious PE headers
|
|
7. WriteProcessMemory(PE sections) -> Write malicious code sections
|
|
8. SetThreadContext(EntryPoint) -> Set new entry point
|
|
9. ResumeThread -> Resume execution with malicious code
|
|
```
|
|
|
|
## Detection Data Sources
|
|
|
|
| Source | Event/Indicator | Description |
|
|
|--------|----------------|-------------|
|
|
| Sysmon Event 1 | Process Create | Process created with suspicious parent |
|
|
| Sysmon Event 8 | CreateRemoteThread | Remote thread in target process |
|
|
| Sysmon Event 25 | ProcessTampering | Image file replaced (Sysmon v13+) |
|
|
| ETW | Microsoft-Windows-Kernel-Process | Kernel-level process events |
|
|
| MDE | ProcessTampering | AlertType for hollowing detection |
|
|
| Memory | Malfind | Volatility plugin for injected code |
|
|
| Memory | VAD analysis | Virtual Address Descriptor anomalies |
|
|
|
|
## Volatility Forensic Commands
|
|
|
|
```bash
|
|
# Detect injected/hollowed processes
|
|
volatility -f memory.dmp --profile=Win10x64 malfind
|
|
|
|
# Compare process memory to disk image
|
|
volatility -f memory.dmp --profile=Win10x64 procdump -p <PID> -D ./dump/
|
|
|
|
# Analyze process memory sections
|
|
volatility -f memory.dmp --profile=Win10x64 vadinfo -p <PID>
|
|
|
|
# Check process image path vs loaded modules
|
|
volatility -f memory.dmp --profile=Win10x64 dlllist -p <PID>
|
|
```
|
|
|
|
## Known Malware Using Process Hollowing
|
|
|
|
| Malware | Target Process | Notes |
|
|
|---------|---------------|-------|
|
|
| Emotet | Multiple | Uses hollowing for persistence |
|
|
| TrickBot | svchost.exe | Hollows svchost for C2 |
|
|
| Dridex | explorer.exe | Financial trojan |
|
|
| FormBook | Various | Infostealer using hollowing |
|
|
| AgentTesla | RegAsm.exe, MSBuild.exe | Targets .NET processes |
|
|
| Remcos | Common utilities | RAT using hollowing |
|
|
| NanoCore | Various | RAT with hollowing capability |
|
|
| AsyncRAT | Various .NET processes | Open-source RAT |
|