Sysmon Event ID 25: Process tampering
Sysmon Event ID 25 records that a running process's memory image was tampered with in a way that Sysmon's process-image integrity check detected, logging the affected process's Image, ProcessGuid, and the Type of tampering observed.
- Applicable version
- Sysmon 13.0 and later
- Last reviewed
- 2026-07-12
Trigger Scenarios
Sysmon generates Event ID 25 when it detects that a monitored process's loaded executable image has been replaced or has its disk-to-memory mapping severed. This occurs during process-image replacement techniques such as process herpaderping, where an attacker overwrites the on-disk image after mapping it to obscure the file from scanning, or when a process's section object is backed by a different file than the one visible on disk.
Key Fields
Type
The specific tampering variant detected. The confirmed value "Image is replaced" indicates Sysmon detected a discrepancy between the mapped image in memory and the corresponding file on disk, consistent with process herpaderping or similar image-replacement evasion. This is the concrete observable field value for detection rules.
Image
The full path of the process whose image was found to be tampered with. This is the victim process whose on-disk image was replaced after mapping; it is not the attacker process.
ProcessGuid
Joins this tampering event to the Event ID 1 process-creation record for the affected process, to the Event ID 8 (CreateRemoteThread) or Event ID 10 (ProcessAccess) records if another process interacted with it, and to any network or file events in the same process's lifetime.
Common False Positives
- No widely documented legitimate software is known to produce this event on patched, production Windows systems; false-positive rates for Event ID 25 are generally very low.
- Some advanced packers or self-modifying installers on developer machines may theoretically trigger this, but this is rare.
Related Events
MITRE ATT&CK Mapping
- T1055Process Injection
Detection Notes
T1055 ProcessTampering is generated for process image change/hollowing detections. The real fields are Type and Image: Type = "Image is replaced" for an Image under C:\\Users\\ or C:\\Temp\\ is a concrete hollowing signal; join ProcessGuid to Event ID 1 and Event ID 8.
Sysmon
| where EventID == 25
| where Type == "Image is replaced"
| project TimeGenerated, Computer, User, Image, ProcessGuid, ProcessId, Typeindex=sysmon EventCode=25 Type="Image is replaced"
| table _time, host, User, Image, ProcessGuid, ProcessId, TypeUtcTime: 2026-07-12 09:55:12.440
ProcessGuid: {bbbbbbbb-cccc-dddd-eeee-ffffffffffff}
ProcessId: 3904
Image: C:\Windows\System32\svchost.exe
Type: Image is replaced
User: CORP\jsmith