HackTool - HollowReaper Execution

Title: HackTool - HollowReaper Execution
Status: experimental
Description:Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.
References:
  -https://github.com/vari-sh/RedTeamGrimoire/tree/b5e7635d34db6e1f0398d8847e8f293186e947c5/HollowReaper
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-01
modified:None
Tags:

• -'attack.defense-evasion'
• -'attack.t1055.012'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\HollowReaper.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high