Log Dejargonizer

Sysmon · Event 25

Sysmon Event 25: Process tampering detected

A process's image in memory no longer matches the file it was launched from. That is what process hollowing and herpaderping look like, and there is very little legitimate reason for it — which makes this one of the highest-signal, lowest-volume events Sysmon produces.

Also written as Sysmon 25Sysmon Event ID 25ProcessTamperingprocess image change sysmon

What it means for you

On a personal computer

Only present if you installed Sysmon. It reports a program whose running code was replaced after it started.

For an analyst

Added in Sysmon 13. Detects the mismatch between an image on disk and the image mapped in memory, which is the mechanism behind hollowing and herpaderping. It does not catch every injection technique — reflective loading into an already-running process is a different signal — but what it does report is rarely benign. Expect a small baseline from packers, some installers, and a few security products.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Process Tampering:
  RuleName: -
  UtcTime: 2026-08-28 09:15:02.114
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  Image: C:\Windows\System32\svchost.exe
  Type: Image is replaced
  User: CORP\jbrooks

The fields that decide it

Everything else in the log line is context.

Type
Which tampering pattern was seen.
  • Image is replacedThe mapped image differs from the file it came from. Classic hollowing.
  • Image is locked for accessThe file was locked to frustrate inspection, which is the herpaderping pattern.
Image
The process whose image was tampered with. Attackers pick trusted-looking targets — Windows binaries and common applications.
ProcessGuid
Join on this to pull the process creation event and see how it was launched and by what.
User
The account the process runs under.

Ordinary reasons this happens

Most of the time it is one of these.

  • Some packers and software protectors, which legitimately rewrite their own image at runtime.
  • A handful of installers and self-updating applications.
  • Certain security products that modify processes as part of their own instrumentation.
  • Debugging and instrumentation tooling on developer machines.

When it is not ordinary

Process hollowing.

What gives it awayA legitimate process created suspended, its memory replaced with different code, then resumed. The name and path look trustworthy; the code is not.

ATT&CK T1055.012

Process herpaderping.

What gives it awayThe file on disk is modified after the image is mapped, so anything inspecting the file sees something different from what is running.

ATT&CK T1055

Masquerading as a trusted Windows binary.

What gives it awayTampering reported against a signed system binary, which is exactly the target an attacker wants to be running as.

ATT&CK T1036.005

Evading file-based detection entirely.

What gives it awayTampering on a process whose on-disk file scans clean, because the malicious code only ever exists in memory.

ATT&CK T1055

What to do next

  1. Read the Image. A tampered system binary is a stronger signal than a tampered third-party application.
  2. Join on ProcessGuid to Sysmon Event 1 for the launching command line and the parent process.
  3. Look at the parent. Hollowing is usually preceded by something creating the process suspended.
  4. Check Sysmon Event 3 and 22 for network activity from the same process.
  5. Check how widely the same Image appears with this event across the estate. A packer will be consistent; an intrusion will not.
  6. Treat an unexplained result on a signed Windows binary as an incident rather than a tuning problem.

Queries to run

kql Low enough volume in most environments to read every single one. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 25 | project TimeGenerated, Computer, Image, User, RenderedDescription | order by TimeGenerated desc
kql Tampering against Windows system binaries specifically. This should be close to empty. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 25 | where Image startswith 'C:\\Windows' | project TimeGenerated, Computer, Image, User
sigma There is a reasonable argument for alerting on the event with no filter at all, then tuning out the specific packers your estate actually runs. 
detection:
  selection:
    EventID: 25
  condition: selection

Common questions

What is process hollowing?

An attacker starts a legitimate program in a suspended state, replaces the code in its memory with their own, and lets it run. Everything about the process looks trustworthy — the name, the path, the signature on the file — but the code executing is not what was on disk. Sysmon Event 25 detects the mismatch.

What Sysmon version do I need for Event 25?

Sysmon 13 or later. Earlier versions have no process tampering detection at all, so if you are not seeing these, check the version before assuming your configuration is wrong.

Does Sysmon Event 25 catch all process injection?

No. It detects tampering with a process image — hollowing and herpaderping specifically. Injecting code into an already-running process without altering its image does not produce this event; that is what Events 8 and 10 are for. Use them together.

Is Event 25 ever a false positive?

There is a small legitimate baseline — some packers, a few installers, and certain security products modify process images as part of normal operation. But the volume is low enough that alerting on the event and tuning out the specific programs your estate genuinely runs is a reasonable strategy, which is unusual for a Sysmon event.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026