huntrule

Windows Process Creation: HollowReaper.exe Execution

Flags execution of HollowReaper.exe, a process hollowing shellcode launcher associated with stealth payload execution.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: HollowReaper.exe Execution"
id: 40758258-ae16-4eac-982b-9e4dd834eb52
status: experimental
description: This rule identifies execution of the HollowReaper.exe binary by matching process creation events where the image ends with '\HollowReaper.exe'. HollowReaper is a process-hollowing shellcode launcher, so its execution is a strong indicator of stealthy payload deployment that attempts to run under the context of trusted processes. Detection relies on Windows process creation telemetry that includes the process image path/name.
references:
  - https://github.com/vari-sh/RedTeamGrimoire/tree/b5e7635d34db6e1f0398d8847e8f293186e947c5/HollowReaper
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_hollowreaper.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-01
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.012
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \HollowReaper.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 85d23b42-9a9d-4f8f-b3d7-d2733c1d58f5
    type: derived

What it detects

This rule identifies execution of the HollowReaper.exe binary by matching process creation events where the image ends with '\HollowReaper.exe'. HollowReaper is a process-hollowing shellcode launcher, so its execution is a strong indicator of stealthy payload deployment that attempts to run under the context of trusted processes. Detection relies on Windows process creation telemetry that includes the process image path/name.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.