Process Hollowing
So far, we have successfully injected code into processes
such as explorer.exe or notepad.exe.
Even though our activity is somewhat masked by familiar process names,
we could still be detected since we are generating network activity
from processes that generally do not generate it.
In this section, we’ll migrate to svchost.exe,
which normally generates network activity.
The problem is that all svchost.exe processes
run by default at SYSTEM integrity level,
meaning we cannot inject into them from a lower integrity level.
Additionally, if we were to launch svchost.exe (instead of Notepad)
and attempt to inject into it, the process will immediately terminate.
To address this, we’ll launch a svchost.exe process
and modify it before it actually starts executing.
This is known as Process Hollowing
and should execute our payload without terminating it.