Process Hollowing of ServiceModelReg.exe (ResiLoader/StealC)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•5

Detects signs of process hollowing targeting ServiceModelReg.exe, a technique used by ResiLoader to execute the StealC information stealer. The rule monitors for suspicious cross-process access (high-privilege handles), remote thread creation, and anomalous module loading patterns within the target process.