ET DELETED EXE Using Suspicious IAT NtUnmapViewOfSection Possible Malware Process Hollowing

SID: 2012817Rev: 50 viewsHistory

Sourceet/open

CreatedMay 18, 2011

UpdatedJune 23, 2021

Classificationbad-unknown

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED EXE Using Suspicious IAT NtUnmapViewOfSection Possible Malware Process Hollowing"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"NtUnmapViewOfSection"; nocase; fast_pattern:only; reference:url,blog.spiderlabs.com/2011/05/analyzing-malware-hollow-processes.html; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:bad-unknown; sid:2012817; rev:5; metadata:created_at 2011_05_18, signature_severity Unknown, updated_at 2021_06_23;)

References

url	blog.spiderlabs.com/2011/05/analyzing-malware-hollow-processes.html
url	sans.org/reading_room/whitepapers/malicious/rss/_33649

ET DELETED EXE Using Suspicious IAT NtUnmapViewOfSection Possible Malware Process Hollowing

References

Metadata

Comments (0)