Instrument

VisorHollow

Bill Rondell, Nick Adams & Dade Murphy — instrument — 1 min read — 36 words

Process-injection detection benchmark with Sysmon validation

§ Workflow phase

Instrumentation. The lab's own infrastructure.

VisorHollow is a process-injection detection benchmark, NtMapViewOfSection

WriteProcessMemory chains tested against Sysmon configurations with pass / fail per Event ID.

Used to validate whether an org’s Sysmon ruleset actually catches the injection chains it claims to.

§ instrument layer

Same phase