Fox Tempest - Process Hollowing from Signed Host (T1055.012)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Correlates a Valid-signed executable starting a legitimate Windows binary (e.g., svchost.exe) in a suspended state for memory injection.