{
  "family": "processhijack",
  "sample_count": 187,
  "category": "trojan_generic",
  "description": "Behavior:Win32/ProcessHijack is a generic, heuristic EDR/AV detection for malware that employs advanced 'Defense Evasion' techniques—specifically Process Injection or Process Hollowing—to hide malicious code within the memory space of a legitimate Windows process.<br><br><b>Understanding Process Hijacking</b><br>To an end-user, this behavior is invisible. For incident responders, a 'ProcessHijack' alert is a critical, high-severity warning. It indicates that malware is actively attempting to bypass application whitelisting and endpoint firewalls. Instead of running as <code>malware.exe</code>, the threat allocates memory inside a trusted process (like <code>explorer.exe</code>, <code>svchost.exe</code>, or <code>notepad.exe</code>), writes its malicious code into that space, and creates a remote thread to execute it. This allows the malware's network traffic and file system access to appear as if it is coming from the trusted Windows process.<br><br><b>Execution and Threat Hunting</b><br>This technique is utilized by almost all advanced malware, including ransomware, banking trojans, and state-sponsored RATs. In 'Process Hollowing' (a specific type of hijacking), the malware launches a legitimate process in a suspended state, unmaps (hollows out) its legitimate code from memory, replaces it with the malicious payload, and resumes the thread. Threat hunters must look beyond file-based scanning. EDR platforms detect this by monitoring for anomalous API calls like <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, and <code>CreateRemoteThread</code>.<br><br><b>Forensic Analysis & Impact</b><br>The impact depends entirely on the injected payload, but the presence of this technique guarantees a sophisticated attacker. Incident responders must perform live memory forensics. Dumping the memory of the hijacked process is the only way to extract the unencrypted, actively running malware payload, as it often never touches the disk.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.012",
    "T1055.002",
    "T1055.001",
    "T1562.001",
    "T1106"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.002",
      "name": "Process Injection: Portable Executable Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; process hijacking is the hallmark of active, severe threats like ransomware precursors or interactive attacker sessions.",
    "Do NOT reboot the machine. Capture a full forensic memory image (RAM dump) immediately to preserve the injected, memory-resident payload.",
    "Utilize EDR to suspend (not kill) the hijacked process to halt malicious activity while preserving the memory space for analysis.",
    "Assume the endpoint is severely compromised and perform a full OS rebuild after forensic evidence has been secured."
  ],
  "what_to_avoid": [
    "Do not kill the hijacked process (e.g., svchost.exe) without capturing memory first, as the malicious payload will be permanently lost.",
    "Avoid relying on static disk scans to remediate the threat; the primary payload is often entirely memory-resident."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}