hollow.txt

rule output
{
	meta:
		author = "MITRE Engenuity"
		date = "2/16/2021"
		description = "Used to detect output from hollow.exe"
	
    strings:
        $output1 = "[---> Process Hollow  <---]"
		$output2 = "[*] Running the target executable (%s)"
		$output3 = "-k netsrv"
		$output4 = "Error: Unable to run the target executable. CreateProcess failed with error %d"
		$output5 = "Process created in suspended state (%s PID: %d)"
		$output6 = "Memory unmapped from child process!"
		$output7 = "Error: Invalid executable format."
		$output8 = "Allocating RWX memory in child process."
		$output9 = "Error: Unable to allocate memory in child process. VirtualAllocEx failed with error %d"
		$output10 = "Memory allocated. Address: %#zx"
		$output11 = "Writing executable image into child process."
		$output12 = "New entry point: %#zx"
		$output13 = "Setting the context of the child process's primary thread."
		$output14 = "Resuming child process's primary thread."
		$output15 = "Thread resumed."

    condition:
        all of them
}

rule functions
{
	meta:
		author = "MITRE Engenuity"
		date = "2/16/2021"
		description = "Used to detect funtions associated with hollow.exe"
	
    strings:
		$function1 = "GetLastError"
		$function2 = "VirtualAllocEx"
		$function3 = "ReadProcessMemory"
		$function4 = "CreateProcessA"
		$function5 = "KERNEL32.dll"
		$function6 = "NtGetContextThread"
		$function7 = "NtQueryInformationProcess"
		$function8 = "NtReadVirtualMemory"
		$function9 = "NtClose"
		$function10 = "NtSetContextThread"
		$function11 = "NtWriteVirtualMemory"
		$function12 = "NtUnmapViewOfSection"
		$function13 = "NtTerminateProcess"
		$function14 = "NtResumeThread"
		$function15 = "RtlCaptureContext"
		$function16 = "RtlLookupFunctionEntry"
		$function17 = "RtlVirtualUnwind"
		$function18 = "UnhandledExceptionFilter"
		$function19 = "SetUnhandledExceptionFilter"
		$function20 = "GetCurrentProcess"
		$function21 = "TerminateProcess"
		$function22 = "IsProcessorFeaturePresent"
		$function23 = "QueryPerformanceCounter"
		$function24 = "GetCurrentProcessId"
		$function25 = "GetCurrentThreadId"
		$function26 = "GetSystemTimeAsFileTime"
		$function27 = "InitializeSListHead"
		$function28 = "IsDebuggerPresent"
		$function29 = "GetModuleHandleW"
		$function30 = "ExitProcess"
		$function31 = "VirtualAlloc"

    condition:
        all of them
}

rule hollow_strings
{
	meta:
		author = "MITRE Engenuity"
		date = "7/17/2020"
		description = "Used to detect strings associated with hollow.exe"
	
    strings:
        $string1 = "PAYLOAD:"
		$string2 = "ntdll.dll"
		$string3 = "wininet"
		$string6 = "ProcessHollowing32-64-master"
		$string7 = "ProcessHollowing.pdb"

    condition:
        all of them
}