Process Hollowing Sequence: Suspended Creation + SetThreadContext + ResumeThread on wab.exe/MSBuild.exe

Duo Tech@duotech

•updated Aug 17, 2026•2•0•8

Detects the full process-hollowing sequence (suspended process creation, SetThreadContext, ResumeThread) executed against the same target PID for wab.exe or MSBuild.exe within a short window — the ACRStealer campaign's injection technique.