Contribute a technique
The wiki is a git repo of markdown. Fork it, add a page, open a PR — two maintainers review every merge.
We do not accept weaponized submissions. No working droppers, no live C2 infrastructure, no ransomware payloads, no samples targeting a named victim. Pages must be written for detection engineers and authorized testers, and every technique needs a detection section before it merges.
# the process
- 1Open an issue firstSay which technique you want to document. Maintainers check it is not already covered and that it clears the disclosure policy.
- 2Write the pageUse the frontmatter template below. Overview, call chain, reference implementation, detection — in that order.
- 3Ship a detection with itA technique page without a working Sigma, YARA or memory-scan rule will not be merged. Test it in the lab kit and paste the output.
- 4Open the PRCI builds the page, lints the code samples and runs your rule against the corpus. Two maintainer approvals merge it.
# page template
techniques/injection/your-page.mdx
---
title: Process Hollowing
mitre: T1055.012
category: injection
summary: Replace the image of a suspended process before it ever executes.
platform: [Windows]
updated: '2026-07-21'
author: your-handle
detections: # <- required, at least one
- src: SYSMON EID 8
text: Remote thread with an unbacked start address.
---
## Overview
## The call chain
## Reference implementation
## Detection <- required---
title: Process Hollowing
mitre: T1055.012
category: injection
summary: Replace the image of a suspended process before it ever executes.
platform: [Windows]
updated: '2026-07-21'
author: your-handle
detections: # <- required, at least one
- src: SYSMON EID 8
text: Remote thread with an unbacked start address.
---
## Overview
## The call chain
## Reference implementation
## Detection <- required