Alternatives to PE-sieve
A Windows tool that scans a running process and dumps injected or hollowed code and hooks. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
PE-sieve
A Windows tool that scans a running process and dumps injected or hollowed code and hooks.
Replacements
Listings that take over the same core job as PE-sieve.
HollowsHunter
A Windows scanner that checks every running process for injected code, hollowing and other implants.
HollowsHunter scans all running processes in one pass for hollowing, shellcode and hooks, built on the same PE-sieve engine but broader in scope.
THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise.
THOR Lite scans files, processes and autoruns with YARA and IOC signatures across Windows, Linux and macOS, though it is not open source.
Similar software
Related functionality, not a direct replacement.
pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
Volatility 3
Memory forensics framework for extracting artefacts from RAM images.
YARA
Pattern-matching engine for identifying and classifying malware samples.
