84 pages · 1 contributors
Every technique,
read from both sides.
An open knowledge base for malware research — injection, evasion, persistence and C2. Every page pairs annotated offensive code with the telemetry and detection logic that catches it.
maldev — zsh
❯ maldev search "unbacked executable memory"
resolving…
[T1055.012] Process Hollowing
├─ code hollow.c · 148 lines
└─ detect 4 rules · sigma, yara
[T1620] Reflective DLL Loading
└─ detect 2 rules · etw-ti
❯
red · how it works
Annotated, compilable reference code with the API chain spelled out call by call.
NtUnmapViewOfSection(hProc, imageBase); VirtualAllocEx(hProc, base, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
blue · how it's caught
The matching hunt query, sigma rule and memory artifact — on the same page, never a separate site.
selection: EventID: 10 GrantedAccess: '0x1F3FFF' SourceImage|endswith: '.exe'
# browse by category
Process Injectionhollowing, APC, reflective14 pagesEvasion & Unhookingsyscalls, AMSI, ETW12 pagesLoaders & PackersPE loaders, crypters7 pagesPersistencerun keys, COM, WMI14 pagesCommand & Controlbeacons, tunnelling9 pagesAnti-Analysissandbox, anti-debug5 pagesCredential AccessLSASS, tokens, tickets16 pagesBlue Team & Detectionsigma, yara, forensics7 pages