Malicious HackTool - HollowReaper Execution (via process_creation)

This rule detects use of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the adversary to execute payloads under the guise of trusted binaries.