13 pages · 1 contributors
Every technique,
read from both sides.
An open knowledge base for malware research — injection, evasion, persistence and C2. Every page pairs annotated offensive code with the telemetry and detection logic that catches it.
maldev — zsh
❯ maldev search "unbacked executable memory"
resolving…
[T1055.012] Process Hollowing
├─ code hollow.c · 148 lines
└─ detect 4 rules · sigma, yara
[T1620] Reflective DLL Loading
└─ detect 2 rules · etw-ti
❯
red · how it works
Annotated, compilable reference code with the API chain spelled out call by call.
NtUnmapViewOfSection(hProc, imageBase); VirtualAllocEx(hProc, base, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
blue · how it's caught
The matching hunt query, sigma rule and memory artifact — on the same page, never a separate site.
selection: EventID: 10 GrantedAccess: '0x1F3FFF' SourceImage|endswith: '.exe'
# browse by category
Process Injectionhollowing, APC, reflective8 pagesEvasion & Unhookingsyscalls, AMSI, ETW3 pagesLoaders & PackersPE loaders, crypters0 pagesPersistencerun keys, COM, WMI1 pageCommand & Controlbeacons, tunnelling0 pagesAnti-Analysissandbox, anti-debug0 pagesCredential AccessLSASS, tokens, tickets0 pagesBlue Team & Detectionsigma, yara, forensics1 page