Potential Process Hollowing Activity
Detects when a memory process image does not match the disk image, indicative of process hollowing. This rule specifically looks for 'Image is replaced' events and filters out common legitimate applications that might exhibit similar behavior, such as applications in 'Program Files', 'Windows\System32\wbem\WMIADAP.exe', 'Windows\SysWOW64\wbem\WMIADAP.exe', Opera, and Edge.
Sigma
