Skip to content
λmaldev wiki/
pagesProcess Doppelgänging
T1055.013Windowsx64C / C++

Process Doppelgänging

updated 2026-07-096 min readthehackersbrain
Authorized use only. This material is published for detection engineering, malware analysis and authorized red-team engagements. Running these techniques against systems you do not own or have written permission to test is illegal.

Overview

Doppelgänging exploits a gap between two Windows subsystems. NTFS transactions let a process write file contents that no other reader can see until the transaction commits. Image sections, once created, are independent of the file they came from. Put those together and you can create a process image from bytes that are rolled back before anything else has a chance to read them.

Nothing is unmapped and nothing is written into a remote process, so the entire detection surface of hollowing is absent. What remains is the mismatch between the file the operating system reports for the process and the bytes actually mapped.

Note.

Transacted NTFS has been deprecated by Microsoft for years, which cuts both ways: the API still works, and almost no legitimate software calls it. That makes TxF activity against executables a near-zero-false-positive hunt on its own.

The call chain

  1. 1
    CreateTransaction
    Open an NTFS transaction; everything written inside it is invisible to other readers.
  2. 2
    CreateFileTransacted + WriteFile
    Write the payload into a transacted file — no other process, including AV, sees these bytes.
  3. 3
    NtCreateSection(SEC_IMAGE)
    Create an image section from the transacted file. The section outlives the transaction.
  4. 4
    RollbackTransaction
    Roll back the write. The file on disk reverts; the image section in memory does not.
  5. 5
    NtCreateProcessEx + NtCreateThreadEx
    Build a process directly from the orphaned section and start it.

Detection

SYSMON EID 1
Process creation where the image file's on-disk contents do not match the executed image hash.
ETW-TI
NtCreateProcessEx from a section not associated with any file currently on disk.
BEHAVIOURAL
Transacted file writes (TxF) against an executable path — vanishingly rare in modern software.
MEMORY SCAN
A running process whose main image section has no valid backing FILE_OBJECT path.

The cheapest durable check is the hash comparison at process creation: read the image path Sysmon reports, hash it, and compare against the hash of what was actually mapped. Doppelgänging and every transacted-hollowing hybrid fail that comparison by construction.

Variants & related

T1055.012Process HollowingSame goal, but performs a visible NtUnmapViewOfSection.→T1620Reflective DLL LoadingAvoids disk entirely rather than hiding what touched it.→
Was this page useful?edit this page ↗