Process hollowing of ServiceModelReg.exe for in-memory stealer execution

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•3

Detects multiple signals associated with potential process injection or hollowing involving 'ServiceModelReg.exe'. The rule correlates process creation in a suspended state, memory injection-related actions, outbound network connections from the process, and specific debug strings often associated with automated process hollowing tools.