Technique index
13 pages across 8 categories. Every page carries a reference implementation and at least one tested detection — that pairing is the merge requirement, not a nice-to-have.
T1055.001WindowsT1055.002WindowsT1055.003WindowsT1055.004WindowsT1055.008LinuxT1055.012WindowsT1055.013WindowsT1620Windows
Classic DLL Injection
LoadLibrary in a remote thread. Trivially detected, but the baseline every other technique is measured against.
Module Stomping
Overwrite the .text section of a benign loaded DLL so your code sits in backed memory.
Thread Execution Hijacking
Suspend an existing thread, rewrite its context, point it at your shellcode.
APC Injection
Queue a user-mode APC onto an alertable thread and wait for it to drain.
ptrace Injection
Attach to a live process on Linux and write shellcode straight into its address space.
Process Hollowing
Replace the image of a suspended process before it ever executes.
Process Doppelgänging
Abuse NTFS transactions so the on-disk image never matches what runs.
Reflective DLL Loading
A DLL that maps itself — no LoadLibrary, no module list entry.
T1027.007WindowsT1106WindowsT1562.001Windows
Sleep Obfuscation
Encrypt a beacon's own memory while it waits between check-ins, so scanners find nothing.
Direct & Indirect Syscalls
Skip the ntdll export table entirely by issuing the syscall instruction yourself.
Unhooking ntdll
Restore a clean copy of ntdll from disk to strip userland EDR hooks.
nothing published yet — contribute the first page
nothing published yet — contribute the first page
nothing published yet — contribute the first page
nothing published yet — contribute the first page