All Detections

Potential Process Hollowing Activity

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202506

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Sigma