Process Hollowing — Process hollowing replaces or redirects the meaningful execution content of a process. Attackers retain a legitimate-looking process context while introducing malicious instructions. The technique conceals the relationship between the process’s apparent identity and actual behavior. – Process Injection

Added October 7, 2026

Process Hollowing — Process hollowing runs malicious code within a process created to appear legitimate. The technique commonly replaces or manipulates the process’s expected executable content before execution continues. Attackers use the trusted appearance to complicate detection and investigation.

Added November 6, 2026