Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

Hollow

Noise: RESTRICTED_ACCESS_BLUR_MARKER

In-Memory Execution

Defense Evasion

HOLLOW is a Cobalt Strike Beacon Object File with a companion Aggressor script that performs EarlyBird asynchronous procedure call (APC) injection. It creates the requested Windows process suspended, allocates separate PAGE_EXECUTE_READ memory in the child, writes raw shellcode, queues that address as a user APC on the child’s primary thread, and resumes the thread. The upstream implementation does not unmap the process image or overwrite its PE entry point.

Source

https://github.com/boku7/HOLLOW

Language

C (Beacon Object File) and Cobalt Strike Aggressor Script (CNA)

References

github.com github.com github.com cobaltstrike.com attack.mitre.org

+10 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER