Showboat - Argument-Stripped Process Hollowing (T1055.012)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Identifies process hollowing by detecting svchost.exe spawned without the mandatory -k parameter, a direct indicator of the Showboat loader injecting its telecom-targeting payload.