A municipal malware lab notes a sample consistent with process hollowing concepts used to run code under a legitimate process image. Without rewriting code, what anti-detection goal should analysts document?

Process hollowing describes running malicious code under the appearance of a legitimate process image, making defenders and simple process allow-lists more likely to trust the execution context. Without rewriting implementation details, municipal malware-lab analysts should document the anti-detection goal: concealing execution by blending malicious code with a trusted process context. This recognition-level finding helps city SOC teams look for hollowed or suspicious process relationships, not just unfamiliar process names. Enumerating every open port on the permitting VLAN is network assessment mapping, not process-hollowing anti-detection. Cloning the mayor’s voice for an authorized finance drill concerns deepfake audio, not process-context concealment. Prioritizing CVEs by internet-facing student portals is vulnerability-prioritization work, not the anti-detection goal in this scenario. Exam caveat: GOAA asks you to identify the conceptual goal—concealing execution under a trusted process—not provide exploit recipes or weaponization detail. For a municipal lab/SOC check, flag suspicious parent/child relationships or image-path inconsistencies on permitting hosts; pair EDR process telemetry with memory-aware review where policy allows; do not treat a trusted process name as exculpatory when behavior is wrong; and hunt for related droppers that initiate hollowed execution. Eradicate the chain, not only the visible helper name.