Process Doppelgänging is a process-creation technique that uses transactional file operations to launch code while obscuring the underlying executable content. Attackers use it to evade file-based detection and forensic review. Defenders should inspect unusual process lineage, memory-backed execution, and suspicious use of transaction-related APIs where visible.
How Process Doppelgänging Works
Process Doppelgänging abuses transactional file operations to create a launch path that can look legitimate while the underlying executable content is hidden or later discarded. The technique is attractive because it separates what the system loads from what a file-centric review might later observe.
At a high level, the attacker prepares code in a transaction, maps it into a process context, and then rolls back the file state. That means the process can exist and run even though the disk artefact is incomplete, altered, or absent, which complicates ordinary triage.
Why It Is Effective for Evasion
Process Doppelgänging is dangerous because many defensive workflows still depend on file presence, file reputation, or post-incident file collection. When execution is anchored in memory and the file object is not preserved in the way defenders expect, analysis can lose the easiest breadcrumb trail.
This technique is often discussed alongside other process-creation and process-hollowing patterns because the security problem is similar: execution survives while the observable parentage, image content, or file lineage becomes less trustworthy. The defender has to rely more heavily on runtime telemetry than on the disk image alone.
Detection and Investigation Clues
Detection usually starts with process lineage, memory inspection, and correlations that do not depend on the file still being present. If a process shows unusual ancestry, suspicious creation timing, or memory-backed code that does not match a normal image path, it deserves review.
Defenders should also pay attention to transaction-related API usage, especially where file activity and process creation occur in close proximity. As EDR Evasion and Defence Guide notes, the same environment can also show process injection, unhooking, parent PID spoofing, or telemetry gaps, so a single signal is rarely enough on its own.
Useful review questions are simple: does the executable on disk match the process that is running, is the image path credible, and did the process appear in a way that matches normal software behaviour? When those answers do not line up, treat the process as suspicious even if the file evidence is weak.
Defensive Controls and Response Focus
Because this technique tries to blind file-based review, the best response is layered visibility. Build detections around process creation, memory execution, script or API abuse, and tamper-resistant endpoint telemetry rather than relying only on static file scanning.
When a suspected instance is found, preserve volatile evidence first, then compare the live process state with any available file artefacts and parent-child relationships. If compromise is confirmed, investigate adjacent processes, scheduled tasks, services, and any credential or token exposure that could have followed the execution.
For broader adversary mapping, MITRE ATT&CK Enterprise Matrix helps analysts place the technique in the wider chain of privilege escalation, persistence, and defence evasion, while NIST SP 800-53 Rev 5 Security and Privacy Controls is useful for thinking about audit, system integrity, and configuration controls that strengthen detection and response.
Risk and Threat Considerations
Process Doppelgänging matters because it breaks the normal assumption that a running process can be trusted to leave a stable, reviewable file trail. That creates a practical gap for hunters, incident responders, and forensic analysts who depend on executable artefacts to confirm what actually ran.
Failure mechanism: The attacker launches code through a transaction-backed file state, then obscures or removes the underlying executable evidence, reducing the usefulness of file-centric detection and post-incident review.
Impact: Security teams can miss malicious execution, misclassify the process origin, or delay containment while the attack continues in memory or under a misleading lineage.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1055 — Process Injection | Process Doppelgänging is a process-creation and execution-evasion technique in ATT&CK's process abuse space. |
| Recommendation — Map suspicious process creation to T1055 and hunt for memory-backed execution and lineage anomalies. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Logging of process creation and related events is central to detecting this technique. |
| SI-4 — System Monitoring | Continuous monitoring is needed to detect suspicious runtime behaviour when file evidence is obscured. | |
| SI-7 — Software, Firmware, and Information Integrity | Integrity controls help surface tampering where the on-disk image no longer matches observed execution. | |
| Recommendation — Log process creation, file, and API events so doppelgänging activity can be correlated during triage. Monitor endpoint behaviour for unusual process lineage, memory execution, and transaction API abuse. Validate executable integrity and investigate mismatches between running code and file artefacts. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Audit logs provide the event history needed to correlate suspicious process creation and tampering. |
| CIS-10 — Malware Defenses | Malware defenses are relevant because the technique is used to evade detection and launch malicious code. | |
| Recommendation — Centralise and review endpoint audit logs for unusual process and file activity. Tune malware defenses to look beyond file signatures and inspect runtime execution behaviour. | ||
Related resources from NHI Mgmt Group
- Why do NHI programmes need stronger process ownership than many human identity programmes?
- How should organisations govern API partner onboarding as a non-human identity process?
- How can security teams apply GRC maturity benchmarks without creating process bloat?
- Should organisations use the same process for onboarding people and machine identities?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org