hollows_hunter

No entries match these filters. Clear filters

1. v0.4.0 Dec 14, 2024 · release notes

   hollows_hunter v0.4.0 adds ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. listener mode via /etw flag and new PE-sieve CLI params

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.4.0 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.4.0

   • /etw flag enables ETW listening mode in hollows_hunter (64-bit only)
   • HH_ETWProfile.ini controls which ETW event types are listened to
   • /rebase and /report flags added via updated CLI following PE-sieve changes

   3 details in Everything

2. v0.3.9 Feb 24, 2024 · release notes

   hollows_hunter v0.3.9 adds /pattern CLI flag for custom signature scanning

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.3.9 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.3.9

   └──▷ HOW TO FIND IT
   Scan a target process using a locally defined custom signature file to detect specific shellcode patterns.
   📍hollows_hunter.exe /process:1234 /pattern /path/to/custom_sigs.txt
   • Adds the /pattern <file> CLI argument to supply custom signatures for memory scanning, with SigFinder format support and optional .pattern.tag output

   1 detail in Everything

3. v0.3.8.1 Nov 10, 2023 · release notes

   Adds /obfusc scan option to hollows_hunter

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.3.8.1 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.3.8.1

   • Adds scan options group with /obfusc parameter

   1 detail in Everything

4. v0.3.8 Nov 9, 2023 · release notes

   Adds --pe-sieve-options=/obfusc and expanded /shellc support in hollows_hunter v0.3.8

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.3.8 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.3.8

   • /obfusc parameter is now supported as an option passed to the embedded PE-sieve engine.
   • The /shellc parameter for PE-sieve now accepts a wider set of options.

   2 details in Everything

5. v0.3.5 Nov 6, 2022 · release notes

   v0.3.5 adds PE resource version info extraction to hollows_hunter

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.3.5 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.3.5

   • Adds version information extraction for PE resources in the updated PE-sieve engine (v0.3.5)

   1 detail in Everything

6. v0.3.4 Feb 10, 2022 · release notes

   Adds /threads flag to scan thread callstacks for sleeping beacons and changes to /mignore.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.3.4 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.3.4

   • Supports new PE-sieve parameter /threads: enabling scan of the threads' callstack as a shellcode detection layer.
   • Updates implementation of the /mignore flag.

   2 details in Everything

7. v0.3.3 Jan 24, 2022 · release notes

   HollowsHunter v0.3.3 adds /cache CLI parameter for optional caching and a default dump directory.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.3.3 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.3.3

   └──▷ TRY IT
   Enable caching for a scan while storing results in the new default directory.
   copy

   $ ./hollows_hunter.exe /cache /i

   • Adds hollows_hunter.exe /cache flag to enable optional process memory scanning cache
   • Sets default output directory to hollows_hunter.dumps when no explicit path is specified

   2 details in Everything

8. v0.3.2 Dec 28, 2021 · release notes

   Adds import reconstruction modes R0-R2 via /imp and automatic /refl toggle with inaccessible data scans

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.3.2 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.3.2

   • Adds /imp flag to specify import reconstruction mode from restrictive (R0) to aggressive (R2)
   • Automatically enables /refl mode when scanning inaccessible memory regions (e.g., /data 4 or /data 5)

   2 details in Everything

9. v0.2.9.8 Jun 27, 2021 · release notes

   Adds /pignore CLI flag to exclude specific processes from scan

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.2.9.8 https://github.com/hasherezade/hollows_hunter.git
   # already have the repo? check out this version:
   $ git checkout v0.2.9.8

   └──▷ TRY IT
   Exclude a specific suspicious process from the HollowsHunter scan.
   copy

   $ ./hollows_hunter.exe /pignore "suspicious_process.exe"

   • Implements a new default value of 0 for the /ptimes flag when no value is provided, scanning all processes created after HH started.

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !The /mfilter parameter has been removed and will no longer be recognized by the tool.
10. v0.2.9.5 Apr 30, 2021 · release notes

    Adds --ptimes and --jlvl parameters for time-bound scanning and JSON detail control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.9.5 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.9.5

    └──▷ TRY IT
    Scan only for hollowed processes injected within the last 300 seconds to reduce noise from long-running benign activity.
    copy

    $ hollows_hunter --ptimes 300

    • Adds ptimes parameter to limit scan to processes created a defined number of seconds before HollowsHunter started
    • Adds jlvl parameter to regulate the level of details included in the JSON report and list hooks/patches in the scan_report

    2 details in Everything

11. v0.2.8.3 Jul 16, 2020 · release notes

    hollows_hunter v0.2.8.3 adds /dnet policy support and fixes IAT scan hangs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.8.3 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.8.3

    └──▷ TRY IT
    Scan a target process with the new .NET policy using the /dnet flag.
    copy

    $ hollows_hunter.exe /process <pid> /dnet

    • /dnet parameter added to apply an additional .NET policy during scanning

    1 detail in Everything

12. v0.2.8 Jul 12, 2020 · release notes

    hollows_hunter v0.2.8 adds /dnet parameter for .NET modules, detailed parameter info syntax, and new /data modes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.8 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.8

    • Adds /dnet parameter to treat .NET modules differently from native ones
    • Supports new modes in the /data parameter
    • Enables detailed info for a single parameter via /<parameter> ? syntax (e.g. /hollows ?)
    • Alerts if the scanner bitness differs from the OS
    • Displays whether the scanned process is 32-bit when scanning on a 64-bit OS

    +1 more show less

    • Alerts about partially scanned processes (64-bit process scanned by a 32-bit scanner)

    6 details in Everything

13. v0.2.7.1 Jun 15, 2020 · release notes

    hollows_hunter v0.2.7.1 adds Scan virtual caves capability via updated PE-sieve

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.7.1 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.7.1

    • Adds Scan virtual caves feature to detect memory regions not visible in standard process snapshots

    1 detail in Everything

14. v0.2.7 Jun 14, 2020 · release notes

    hollows_hunter v0.2.7 adds /refl parameter for process reflection and static PE-sieve support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.7 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.7

15. v0.2.6 Apr 13, 2020 · release notes

    hollows_hunter v0.2.6 adds /iat flag for scanning IAT Hooking via PE-sieve update

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.6 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.6

    • Adds /iat CLI argument to enable scanning for IAT Hooking techniques

    1 detail in Everything

16. v0.2.5 Mar 9, 2020 · release notes

    hollows_hunter v0.2.5 adds /pid argument to scan specific processes and improves CLI output with colors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.5 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.5

    • Improves CLI output with colored console logs and explicit scanned process name display

    1 detail in Everything

17. v0.2.4 Dec 30, 2019 · release notes

    hollows_hunter v0.2.4 adds JSON output and multi-process name support to /pname

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.4 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.4

    • Adds /json flag to output the scanning summary as a JSON report instead of text.
    • Updates /pname parameter to accept semicolon-separated process names (e.g., iexplore.exe;firefox.exe) for targeted scanning.

    2 details in Everything

18. v0.2.2.7 Oct 18, 2019 · release notes

    hollows_hunter v0.2.2.7 adds Linux-style parameter switches and /minidmp support via updated PE-sieve.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.2.7 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.2.7

    • Adds /minidmp CLI argument to create MiniDumps of suspicious processes
    • Enables Linux-style parameter switches (e.g., -shellc) as equivalent to Windows-style /shellc

    2 details in Everything

19. v0.2.2.6 Aug 15, 2019 · release notes

    Adds /suspend flag to automatically suspend suspicious processes detected by hollows_hunter.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.2.6 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.2.6

    └──▷ TRY IT
    Scan a target and automatically suspend any suspicious processes to preserve evidence.
    copy

    $ hollows_hunter.exe /suspend

    • Adds /suspend parameter to automatically suspend processes flagged as suspicious
    • Prints bitness information in the banner output

    2 details in Everything

20. v0.2.2.5 Jun 16, 2019 · release notes

    Adds the /data flag to hollows_hunter to enable scanning of non-executable memory regions when DEP is disabled

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.2.5 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.2.5

21. v0.2.2 Jun 12, 2019 · release notes

    hollows_hunter v0.2.2 adds /default flag to display current default settings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.2 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.2

    • Adds /default CLI argument to display information about the default settings

    1 detail in Everything

22. v0.2.1 May 23, 2019 · release notes

    Adds /log flag and JSON summary output for hollows_hunter v0.2.1

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.1 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.2.1

    • Adds the /log parameter to enable appending scan summaries to hollows_hunter.log
    • Generates a new JSON report named summary.json after each scan

    2 details in Everything

23. v0.1.9 Dec 18, 2018 · release notes

    hollows_hunter v0.1.9 adds /dir and /uniqd CLI options to control dump output location

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.9 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.1.9

    └──▷ USE IT
    Save all dump files to a specific folder instead of the default location.
    shell copy

    ./hollows_hunter.exe /dir C:\cyber\dumps

    Automatically manage output directories with timestamped names for each execution.
    shell copy

    ./hollows_hunter.exe /uniqd

    • Adds the /dir option to set a specific root directory for memory dumps
    • Adds the /uniqd option to create unique, timestamped directories for each run's results
    • Improves error reporting by informing the user when an invalid parameter is supplied

    3 details in Everything

24. v0.1.8 Nov 5, 2018 · release notes

    hollows_hunter v0.1.8 adds /dmode for dump mode selection and /version for version printing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.8 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.1.8

    • Adds /dmode flag to select dump mode
    • Adds /version flag to print the tool's version

    2 details in Everything

25. v0.1.5 Nov 5, 2018 · release notes

    hollows_hunter v0.1.5 adds /pname, /loop, and /kill CLI flags for selective, continuous scanning with auto-remediation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.5 https://github.com/hasherezade/hollows_hunter.git
    # already have the repo? check out this version:
    $ git checkout v0.1.5

    • /pname <process_name> enables filtering scans to specific process names instead of targeting all processes
    • /loop activates continuous monitoring mode for persistent detection
    • /kill automatically terminates processes identified as suspicious during a scan

    3 details in Everything