Codex - Process Hollowing into .NET Framework Binaries (T1055.012)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Identifies PowerShell spawning Microsoft .NET binaries (RegAsm.exe, InstallUtil.exe, AppLaunch.exe) without command-line arguments, which is indicative of process hollowing or injection by the Codex malware to inject its final stage.