An open knowledge base for malware research — injection, evasion, persistence and C2, each technique paired with the detection logic that catches it.https://maldev.thehackersbrain.devenhttps://maldev.thehackersbrain.dev/techniques/injection/process-hollowinghttps://maldev.thehackersbrain.dev/techniques/injection/process-hollowingReplace the image of a suspended process before it ever executes.Tue, 21 Jul 2026 00:00:00 GMTProcess InjectionT1055.012Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/evasion/sleep-obfuscationhttps://maldev.thehackersbrain.dev/techniques/evasion/sleep-obfuscationEncrypt a beacon's own memory while it waits between check-ins, so scanners find nothing.Sun, 19 Jul 2026 00:00:00 GMTEvasion & UnhookingT1027.007Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/evasion/unhooking-ntdllhttps://maldev.thehackersbrain.dev/techniques/evasion/unhooking-ntdllRestore a clean copy of ntdll from disk to strip userland EDR hooks.Sun, 19 Jul 2026 00:00:00 GMTEvasion & UnhookingT1562.001Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/detection/unbacked-executable-memoryhttps://maldev.thehackersbrain.dev/techniques/detection/unbacked-executable-memoryThe single highest-yield structural hunt across the whole injection category.Tue, 14 Jul 2026 00:00:00 GMTBlue Team & DetectionT1055Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/injection/reflective-dll-loadinghttps://maldev.thehackersbrain.dev/techniques/injection/reflective-dll-loadingA DLL that maps itself — no LoadLibrary, no module list entry.Sun, 12 Jul 2026 00:00:00 GMTProcess InjectionT1620Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/persistence/com-hijackinghttps://maldev.thehackersbrain.dev/techniques/persistence/com-hijackingRemap a system CLSID to your own object so a trusted process loads it for you.Sat, 11 Jul 2026 00:00:00 GMTPersistenceT1546.015Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/injection/process-doppelganginghttps://maldev.thehackersbrain.dev/techniques/injection/process-doppelgangingAbuse NTFS transactions so the on-disk image never matches what runs.Thu, 09 Jul 2026 00:00:00 GMTProcess InjectionT1055.013Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/evasion/direct-syscallshttps://maldev.thehackersbrain.dev/techniques/evasion/direct-syscallsSkip the ntdll export table entirely by issuing the syscall instruction yourself.Wed, 08 Jul 2026 00:00:00 GMTEvasion & UnhookingT1106Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/injection/thread-execution-hijackinghttps://maldev.thehackersbrain.dev/techniques/injection/thread-execution-hijackingSuspend an existing thread, rewrite its context, point it at your shellcode.Sat, 04 Jul 2026 00:00:00 GMTProcess InjectionT1055.003Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/injection/module-stompinghttps://maldev.thehackersbrain.dev/techniques/injection/module-stompingOverwrite the .text section of a benign loaded DLL so your code sits in backed memory.Tue, 30 Jun 2026 00:00:00 GMTProcess InjectionT1055.002Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/injection/ptrace-injectionhttps://maldev.thehackersbrain.dev/techniques/injection/ptrace-injectionAttach to a live process on Linux and write shellcode straight into its address space.Thu, 11 Jun 2026 00:00:00 GMTProcess InjectionT1055.008Linuxthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/injection/classic-dll-injectionhttps://maldev.thehackersbrain.dev/techniques/injection/classic-dll-injectionLoadLibrary in a remote thread. Trivially detected, but the baseline every other technique is measured against.Tue, 02 Jun 2026 00:00:00 GMTProcess InjectionT1055.001Windowsthehackersbrainhttps://maldev.thehackersbrain.dev/techniques/injection/apc-injectionhttps://maldev.thehackersbrain.dev/techniques/injection/apc-injectionQueue a user-mode APC onto an alertable thread and wait for it to drain.Tue, 19 May 2026 00:00:00 GMTProcess InjectionT1055.004Windowsthehackersbrain