Komari C2 - Process Hollowing into Svchost (T1055.012)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Detects the Komari agent spawning svchost.exe in a suspended state (no arguments) and writing memory into it to hide malicious execution. The rule identifies svchost.exe processes launched without the '-k' argument (indicating a suspended state) and then correlates these launches with subsequent 'WriteProcessMemoryApiCall' events targeting the same process within a one-minute window.