Kazuar - Process Hollowing into Taskhostw (T1055.012)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects Kazuar executing process hollowing into legitimate Windows binaries like taskhostw.exe to blend in with normal OS behavior. This rule specifically looks for instances where 'taskhostw.exe' is the target process but its command line does not contain 'taskhostw.exe', indicating a potential suspended or hollowed launch, combined with network activity originating from that process.