HackTool - HollowReaper Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•16

Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.