Windows Process Creation: HollowReaper.exe Execution for Process Hollowing

Flags execution of HollowReaper.exe, a process hollowing shellcode launcher associated with stealth payload execution.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-07-01
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055.012Process Hollowing
Defense Evasion
- T1055.012Process Hollowing
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where the executable path ends with HollowReaper.exe. HollowReaper is a process hollowing shellcode launcher, and its use matters because it enables stealthy payload execution by replacing the memory of a legitimate process with custom shellcode. The detection relies on Windows process creation telemetry that includes the image name/path for each new process.

Reporting behind it

Related detections9 linkedT1055.012 — drag to rearrange

Suspicious MSBuild Spawned by PowerShell (via process_creation)

Suspicious RegSvcs Execution Spawned by Script Interpreter for Process Hollowing (via process_creation)

Suspicious MSBuild Execution Spawned by PowerShell via PhantomVAI Loader (via process_creation)

Suspicious Rundll32 Loading Non-DLL Image Extension File

Suspicious MSBuild Execution Spawned by Command Shell for Process Hollowing (via process_creation)

Malicious Desktop Window Manager Impersonation From Non-System Path via process_creation

Suspicious .NET Utility Spawned by AutoHotkey Loader for Process Hollowing (via process_creation)

Suspicious csc.exe Spawned by Document Reader for Process Injection

Suspicious RegAsm Execution Spawned by Script Host for Process Hollowing (via process_creation)

Windows Process Creation: HollowReaper.exe Execution for Process Hollowing

Pivot detection · T1055.012 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-hollowreaper-exe-execution-85d23b42

title: "Windows Process Creation: HollowReaper.exe Execution for Process Hollowing"
id: 40758258-ae16-4eac-982b-9e4dd834eb52
status: experimental
description: This rule identifies process creation events where the executable path ends with HollowReaper.exe. HollowReaper is a process hollowing shellcode launcher, and its use matters because it enables stealthy payload execution by replacing the memory of a legitimate process with custom shellcode. The detection relies on Windows process creation telemetry that includes the image name/path for each new process.
references:
  - https://github.com/vari-sh/RedTeamGrimoire/tree/b5e7635d34db6e1f0398d8847e8f293186e947c5/HollowReaper
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_hollowreaper.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-01
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.012
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \HollowReaper.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 85d23b42-9a9d-4f8f-b3d7-d2733c1d58f5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL