25 Sysmon log · ProcessTampering critical severity low volume

Sysmon Event ID 25 — Process image was tampered (Hollowing/Herpaderping)

Process image does not match the file on disk. Indicates process hollowing, process herpaderping, or process doppelganging.

Why event 25 matters

Process hollowing (T1055.012): attacker creates legitimate process (svchost.exe), unmaps its memory, and replaces with malicious payload. Detection: Sysmon compares running image hash to on-disk hash — mismatch = hollowing. Also detects Process Herpaderping and Doppelganging. Very low false-positive rate.

How to detect it

Alert on every occurrence. Process image mismatch is near-definitive evidence of process hollowing. Capture the process memory for forensic analysis. This event has extremely low false-positive rate.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Process Injection: Process Hollowing (T1055.012)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Process Hollowing Detected
status: stable
description: Process image tampered — process hollowing or herpaderping
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 25
    condition: selection
falsepositives:
    - Extremely rare; some legitimate packing tools
level: critical
tags:
    - attack.defense_evasion
    - attack.t1055.012
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 25   // Process image was tampered (Hollowing/Herpaderping)
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=25
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Process image was tampered (Hollowing/Herpaderping) — add EventData fields: Image, CommandLine, ParentImage, User`
Hunt event 25 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 25?

Process image was tampered (Hollowing/Herpaderping). Process image does not match the file on disk. Indicates process hollowing, process herpaderping, or process doppelganging.

Which log records event 25?

Event 25 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 25?

Event 25 is associated with: Process Injection: Process Hollowing (T1055.012).

How do you detect activity around event 25?

Alert on every occurrence. Process image mismatch is near-definitive evidence of process hollowing. Capture the process memory for forensic analysis. This event has extremely low false-positive rate.