Techniques › T1055.013 › AN1501
AN1501 Analytic 1501
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversary abuse of Transactional NTFS (TxF) and undocumented process loading mechanisms (e.g., NtCreateProcessEx) to create a hollowed process from an uncommitted, maliciously tainted file image in memory, later executed via NtCreateThreadEx.</p>
- Detects
- T1055.013 Process Doppelgänging
- Part of
- DET0544 Detection Strategy for Process Doppelgänging on Windows
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| etw:Microsoft-Windows-Kernel-Process | CreateTransaction, CreateFileTransacted, RollbackTransaction, NtCreateProcessEx, NtCreateThreadEx | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TransactionExecutableNamePattern | Pattern of legitimate executables often used as doppelgänging targets (e.g., svchost.exe, calc.exe) |
TimeWindow_TransactionToExecution | Time delta between TxF rollback and thread creation in hollowed process |
ThreadStartEntropyThreshold | Entropy level of thread start address in memory used to detect obfuscated shellcode |
TxF API Call Frequency Threshold | Limit on CreateTransaction + RollbackTransaction sequences per process |