EDR flags a svchost.exe that was started suspended, had its image unmapped, then resumed. What technique is this and what do you do?

The alert names a trusted binary, which is exactly why hollowing works. The task is to recognize the sequence rather than the process name.

The technique

MITRE ATT&CK T1055.012 describes the steps. A legitimate process is created in a suspended state with CreateProcess; its memory is unmapped with ZwUnmapViewOfSection or NtUnmapViewOfSection; malicious code is written into the freed space via VirtualAllocEx and WriteProcessMemory; the thread context is adjusted with SetThreadContext; and ResumeThread runs the payload. MITRE notes it creates a new process rather than targeting an existing one, unlike other injection methods. Its detection strategy targets precisely this call sequence.

Response

1. Contain the host, since the running "svchost.exe" executes attacker code.
2. Capture memory of that process so you can analyze the injected payload, not the benign image on disk.
3. Prevent by behavior: MITRE lists Behavior Prevention on Endpoint (M1040) as the mitigation, blocking common injection sequences.
4. Hunt for the parent process that spawned it and for other hosts.

Why the others fail

Allow-listing by name is what the attacker relies on. DLL side-loading and ransomware are different techniques; deleting a DLL or restoring backups never examines the hollowed process.

What interviewers want

Recognize the API chain, analyze memory, and rely on behavior rather than names.