RunPE is a process injection style technique where malware launches a legitimate looking process and replaces its memory with malicious code. Attackers use it to hide execution, blend into normal process activity, and reduce the usefulness of simple file based detection. It is a common evasion pattern in commodity malware.
How RunPE Works
RunPE is a process injection pattern that starts a legitimate-looking process and then replaces its in-memory execution state with malicious code. The visible process name and file path can look normal while the runtime behaviour is entirely different.
This matters because many security tools and analysts still use the process tree, command line, signer reputation, or file presence as quick triage signals. RunPE undermines that assumption by separating what is on disk from what is actually running.
Why Attackers Use RunPE
Attackers use RunPE to blend into ordinary process activity, reduce obvious malware artefacts, and make detection harder for file-centric controls. The technique is especially attractive in commodity malware because it is straightforward, repeatable, and effective against basic screening.
RunPE is also useful for staging follow-on behaviour after initial execution. Once malicious code runs inside a trusted process, defenders may see a benign parent-child relationship even though the memory content, imported functions, or behaviour no longer match the original image.
Detection and Defensive Challenges
RunPE is difficult to catch with file scanning alone because the malicious payload may never persist as a plainly visible executable on disk. Detection usually depends on behavioural signals such as suspicious memory allocation, image replacement, abnormal thread start activity, hollowed processes, or mismatch between the mapped image and runtime execution.
That creates a practical gap between signature-based detection and runtime inspection. Security teams need to correlate process creation, memory state, and execution lineage instead of assuming that a signed or familiar process name is trustworthy on its own. For a control baseline, see NIST SP 800-53 Rev 5 Security and Privacy Controls and map process monitoring, audit, and integrity expectations to the relevant controls.
Related Techniques and Practical Context
RunPE sits within the broader family of process injection and process hollowing behaviours, so it is best understood as an execution and evasion technique rather than a standalone malware type. It often appears alongside other stealth mechanisms that try to hide malicious payloads inside normal system activity.
For threat modelling and detection engineering, the most useful question is not whether a process looks legitimate, but whether the runtime state matches the expected image, ancestry, and behaviour. MITRE ATT&CK Enterprise Matrix is the most useful reference for placing RunPE-style behaviour in an adversary technique context and aligning detections to the broader attack chain.
Risk and Threat Considerations
RunPE raises the risk that malicious code will execute inside an otherwise trusted process and evade controls that rely on file reputation or visible process names. That makes initial compromise harder to spot and can give attackers a cleaner path to persistence, credential abuse, or lateral movement.
Failure mechanism: The attacker launches a legitimate process, replaces or unmapped its original memory image, and runs the payload under a trusted-looking execution context, which weakens simple allowlisting and binary inspection.
Impact: Defenders may miss active compromise, misattribute suspicious activity to a benign process, and lose visibility into the real payload until the attack has already progressed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1055 — Process Injection | RunPE is a process injection technique that replaces a process's memory with malicious code. |
| Recommendation — Map hollowing indicators to T1055 and hunt for injected execution inside trusted processes. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | RunPE detection depends on process and memory telemetry that must be logged and reviewed. |
| SI-4 — System Monitoring | RunPE is primarily identified through behavioural monitoring and runtime anomaly detection. | |
| CM-8 — System Component Inventory | Process-hiding malware is easier to spot when component inventory and execution lineage are known. | |
| Recommendation — Log process creation and memory events so injection patterns can be investigated. Monitor runtime process behaviour for hollowing, image mismatch, and suspicious memory changes. Maintain accurate component inventory to distinguish expected processes from injected ones. | ||
Practitioner Guidance
What to watch for: Treat RunPE as a runtime integrity problem, not a file-only detection problem. Focus investigations on image mismatches, unusual memory protection changes, hollowed processes, and execution that does not align with the original binary path or signer.
Practitioner takeaway: The more your controls depend on what a process appears to be on disk, the easier RunPE becomes to abuse.
