Alternatives to HollowsHunter
A Windows scanner that checks every running process for injected code, hollowing and other implants. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
HollowsHunter
A Windows scanner that checks every running process for injected code, hollowing and other implants.
Replacements
Listings that take over the same core job as HollowsHunter.
PE-sieve
A Windows tool that scans a running process and dumps injected or hollowed code and hooks.
PE-sieve is the underlying engine, scanning a single running process for injected PEs, shellcode and hooks and dumping them for analysis.
THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise.
THOR Lite scans files, processes and autoruns with YARA and IOC signatures across Windows, Linux and macOS rather than only checking injected code.
Similar software
Related functionality, not a direct replacement.
Sysmon
A Sysinternals service that logs detailed process, network and file activity to the Windows event log.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
PE-bear
A multiplatform viewer and editor for reversing Windows Portable Executable (PE) files.
Autoruns
A Sysinternals utility that shows every program and driver configured to start automatically on Windows.
Volatility 3
Memory forensics framework for extracting artefacts from RAM images.
pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators.
