SOC Event Lookup
Event ID 25ProcessP2

Sysmon Event ID 25: Process tampering

Applicable version
Sysmon 13.0 and later
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 25 records that a running process's memory image was tampered with in a way that Sysmon's process-image integrity check detected, logging the affected process's Image, ProcessGuid, and the Type of tampering observed.

Technical Metadata

Technical metadata for Event ID 25
Event ID25
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0004 Privilege Escalation / T1055.012 Process Injection: Process Hollowing
Key fields to watchType, Image, ProcessGuid

Trigger Scenarios

Sysmon generates Event ID 25 when it detects that a monitored process's loaded executable image has been replaced or has its disk-to-memory mapping severed. This occurs during process-image replacement techniques such as process herpaderping, where an attacker overwrites the on-disk image after mapping it to obscure the file from scanning, or when a process's section object is backed by a different file than the one visible on disk.

Key Fields

Type

The specific tampering variant detected. The confirmed value "Image is replaced" indicates Sysmon detected a discrepancy between the mapped image in memory and the corresponding file on disk, consistent with process herpaderping or similar image-replacement evasion. This is the concrete observable field value for detection rules.

Image

The full path of the process whose image was found to be tampered with. This is the victim process whose on-disk image was replaced after mapping; it is not the attacker process.

ProcessGuid

Joins this tampering event to the Event ID 1 process-creation record for the affected process, to the Event ID 8 (CreateRemoteThread) or Event ID 10 (ProcessAccess) records if another process interacted with it, and to any network or file events in the same process's lifetime.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 25
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 25
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 25
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=25
| table _time, host, EventCode, Message
Data source
Splunk Windows Sysmon event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Sysmon Event ID 25
dataset = microsoft_windows_raw
| filter edr_event_id = 25
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Sysmon Event ID 25
title: Sysmon Event ID 25
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 25
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID25Sysmon detected a process image change associated with hiding techniques.Interpret EventID with the full event and correlated activity; this value alone is not proof of compromise. Source
TypeImage is replacedThe ProcessTampering type indicating replacement of the process image.Interpret Type with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1055.012Process Injection: Process Hollowing

Detection Notes

T1055.012 Process Hollowing is generated for process image change/hollowing detections. The real fields are Type and Image: Type = "Image is replaced" for an Image under C:\\Users\\ or C:\\Temp\\ is a concrete hollowing signal; join ProcessGuid to Event ID 1 and Event ID 8.

Common False Positives

  • No widely documented legitimate software is known to produce this event on patched, production Windows systems; false-positive rates for Event ID 25 are generally very low.
  • Some advanced packers or self-modifying installers on developer machines may theoretically trigger this, but this is rare.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-12 09:55:12.440
ProcessGuid: {bbbbbbbb-cccc-dddd-eeee-ffffffffffff}
ProcessId: 3904
Image: C:\Windows\System32\svchost.exe
Type: Image is replaced
User: CORP\jsmith

Frequently Asked Questions

What does Sysmon Event ID 25 mean?

Sysmon detected process-image tampering such as hollowing or herpaderp behavior.

Does Event ID 25 always indicate malicious activity?

It is high-signal but still requires validation against security software and unusual platform behavior.

How should Event ID 25 be investigated?

Review Type and Image and correlate ProcessGuid with process creation, memory and thread telemetry.

Sources

Machine-readable JSON