Technique index
84 pages across 8 categories. Every page carries a reference implementation and at least one tested detection — that pairing is the merge requirement, not a nice-to-have.
T1055WindowsT1055WindowsT1055WindowsT1055.001WindowsT1055.002WindowsT1055.002WindowsT1055.003WindowsT1055.004WindowsT1055.004WindowsT1055.008LinuxT1055.012WindowsT1055.013WindowsT1574.002WindowsT1620Windows
Atom Bombing
Abuse the Windows global atom table to write shellcode into a target process and execute it via an APC queue.
Pool Party Injection
Abuse undocumented Windows thread pool work items to execute code in a remote process without CreateRemoteThread or QueueUserAPC.
Process Ghosting
Write a payload to a pending-delete file so Windows maps it into memory before the file is gone.
Classic DLL Injection
LoadLibrary in a remote thread. Trivially detected, but the baseline every other technique is measured against.
Module Stomping
Overwrite the .text section of a benign loaded DLL so your code sits in backed memory.
PE Injection
Allocate memory in a target process, write a full PE image into it, resolve its imports, and execute it — without writing a file to disk.
Thread Execution Hijacking
Suspend an existing thread, rewrite its context, point it at your shellcode.
APC Injection
Queue a user-mode APC onto an alertable thread and wait for it to drain.
Early Bird APC Injection
Queue a shellcode APC to a freshly created suspended process before its first instruction runs.
ptrace Injection
Attach to a live process on Linux and write shellcode straight into its address space.
Process Hollowing
Replace the image of a suspended process before it ever executes.
Process Doppelgänging
Abuse NTFS transactions so the on-disk image never matches what runs.
DLL Side-Loading
Drop a malicious DLL beside a legitimate signed application that loads it by relative path, inheriting the application's trust and execution context.
Reflective DLL Loading
A DLL that maps itself — no LoadLibrary, no module list entry.
T1027WindowsT1027.007WindowsT1027.007WindowsT1027.011Windows, LinuxT1036.005WindowsT1036.007WindowsT1106WindowsT1134.004WindowsT1562.001WindowsT1562.001WindowsT1562.001WindowsT1562.006Windows
IAT Obfuscation
Hide imported API calls from static analysis by resolving function addresses at runtime instead of declaring them in the PE import table.
Heap / Stack Encryption During Sleep
Encrypt the beacon's own memory while it sleeps so in-sleep memory scans find nothing recognisable.
Sleep Obfuscation
Encrypt a beacon's own memory while it waits between check-ins, so scanners find nothing.
Control Flow Obfuscation
Restructure a binary's control flow graph to defeat static analysis and signature detection without changing its runtime behaviour.
Call Stack Spoofing
Fabricate a plausible-looking call stack to hide the true origin of API calls made from shellcode or an injected beacon.
Module Overloading
Load a legitimate DLL into memory and overwrite its executable sections with a shellcode payload, inheriting the module's backed memory status.
Direct & Indirect Syscalls
Skip the ntdll export table entirely by issuing the syscall instruction yourself.
Parent PID Spoofing
Set an arbitrary parent process handle when creating a new process to fool parent-child heuristics.
AMSI Bypass
Patch or neutralise the Antimalware Scan Interface so PowerShell and .NET payloads run uninspected.
Indirect Syscalls & Hell's Gate
Dynamically resolve System Service Numbers at runtime and call them via trampolines in ntdll, bypassing EDR hooks without patching ntdll.
Unhooking ntdll
Restore a clean copy of ntdll from disk to strip userland EDR hooks.
ETW Patching & Disabling
Disable Event Tracing for Windows (ETW) in the current process by patching the EtwEventWrite function in ntdll, preventing security tools from receiving ETW telemetry.
T1027WindowsT1027.009WindowsT1027.009Windows, LinuxT1027.009Windows, LinuxT1059.006WindowsT1620WindowsT1620Windows
PE Packer / Crypter
Wrap a PE inside an encrypted stub that unpacks and maps the payload at runtime.
Donut Shellcode Generation
Convert any PE, .NET assembly, or VBScript into position-independent shellcode using the Donut framework for fileless in-memory execution.
Position-Independent Code (Shellcode)
Write code that runs at any memory address without relocation — the basis of every staged payload.
Encrypted Shellcode Loader
Decrypt and execute shellcode at runtime so the payload never touches disk in plaintext.
Beacon Object File (BOF) Development
Write position-independent C code that executes inside a Cobalt Strike or Havoc beacon process without spawning a new process or touching disk.
Manual PE Mapping
Map a PE into memory by hand - parse the headers, reserve sections, and patch relocations without a loader.
PE to Shellcode
Embed a PE as bytes in position-independent shellcode that reflects the image into memory and jumps to its entry point.
T1053.005WindowsT1542.003Windows, LinuxT1543.003WindowsT1546.003WindowsT1546.012WindowsT1546.015WindowsT1547.001WindowsT1547.001WindowsT1547.001WindowsT1547.001WindowsT1547.004WindowsT1547.009WindowsT1574.001WindowsT1574.012Windows
Scheduled Task Persistence
Register a Windows scheduled task to execute a payload on a schedule or system event.
Bootkit Persistence
Implant malicious code in the Master Boot Record or UEFI firmware to survive OS reinstallation and persist below the operating system.
Windows Service Creation
Install a malicious Windows service that auto-starts at boot under the SYSTEM account.
WMI Event Subscription
Register a permanent WMI consumer to execute a payload when a system event fires.
IFEO Debugger Hijack
Abuse the Image File Execution Options debugger key to intercept any process launch and silently substitute a malicious payload.
COM Hijacking via TreatAs
Remap a system CLSID to your own object so a trusted process loads it for you.
Active Setup
Use the Internet Explorer Active Setup key to run a command once for each user that logs on.
AppInit_DLLs & AppCertDlls
Register a DLL that Explorer or every new process loads at logon through AppInit or an AppCert certification hook.
Registry Run Keys
Write a value under a Run key so Windows executes a payload on every user logon.
Startup Folder
Drop an executable in a user or common Startup folder so the shell runs it at every logon.
Winlogon Userinit & Helper DLL
Point Winlogon's Userinit or register a Helper DLL so a payload loads into the logon manager at every interactive logon.
LNK File Hijacking
Plant or replace Windows shortcut files in Startup folders or on the desktop to execute arbitrary payloads on user logon.
DLL Search Order Hijacking
Plant a malicious DLL in a directory the loader searches before the legitimate one.
Print Spooler DLL Hijacking
Exploit the Windows Print Spooler service's dynamic loading of print provider and monitor DLLs to achieve persistence or privilege escalation.
T1021.002WindowsT1071.001Windows, Linux, macOST1071.001Windows, Linux, macOST1071.002WindowsT1071.004Windows, Linux, macOST1071.004Windows, Linux, macOST1071.004Windows, Linux, macOST1090.004Windows, Linux, macOST1095Windows, Linux
SMB / Windows Admin Share C2
Use admin shares and SMB file operations as a low-bandwidth command and control channel inside a LAN.
HTTP/S Beaconing
Use malleable HTTP profiles to make beacon traffic look like legitimate browser requests.
WebSocket C2 Channel
Use persistent WebSocket connections over HTTPS to maintain a full-duplex C2 channel that blends with web application traffic.
SMB Named Pipe C2
Route implant traffic over SMB named pipes to blend with legitimate file-share traffic.
DNS Beaconing
Tunnel C2 traffic inside DNS queries so it blends with legitimate resolver noise.
DNS-over-HTTPS C2
Tunnel C2 traffic through DNS-over-HTTPS providers, encrypting DNS queries so network sensors cannot inspect subdomain labels.
LDAP C2
Steer an implant over LDAP, using the directory protocol's bind and search operations as the beacon.
HTTPS Domain Fronting
Route C2 traffic through a trusted CDN provider so network defenders see connections to a legitimate host while traffic reaches the attacker's server.
ICMP Tunneling
Smuggle C2 data inside ICMP Echo request and reply payloads to bypass application-layer filtering.
T1027Windows, Linux, macOST1497Windows, LinuxT1497.001Windows, Linux, macOST1497.003Windows, LinuxT1622Windows
String Encryption
Encrypt string literals at compile time and decrypt them at runtime to remove plaintext IoCs from static analysis.
Sandbox & VM Detection
Fingerprint automated analysis environments and refuse to run inside them.
Hardware Fingerprinting
Hash the machine's hardware identifiers so the implant behaves only on the target and flags sandboxes.
Timing-Based Evasion
Use elapsed-time or CPU-cycle measurements to detect single-stepping, sleep acceleration, and sandboxes.
Anti-Debugging Techniques
Detect or disrupt debuggers to prevent interactive analysis of a running sample.
T1003.001WindowsT1003.002WindowsT1003.003WindowsT1003.006WindowsT1134.001WindowsT1550.002WindowsT1550.002WindowsT1550.003Windows, Linux, macOST1555.004WindowsT1557.001Windows, LinuxT1558WindowsT1558.001WindowsT1558.002WindowsT1558.003WindowsT1558.004WindowsT1558.005Linux, macOS
LSASS Memory Dump
Extract credential material from lsass.exe memory to recover plaintext passwords and hashes.
SAM Dump
Extract local account NTLM hashes from the Security Account Manager registry files for offline use.
NTDS.dit Extraction
Extract all domain credential hashes from the NTDS.dit Active Directory database offline.
DCSync Attack
Impersonate a domain controller to pull every credential hash from AD using the MS-DRSR replication protocol.
Access Token Impersonation
Steal and impersonate a privileged token from a running process to assume its identity.
Overpass the Hash
Turn an NT hash into a Kerberos TGT via the AS-REQ pre-auth, then move laterally without the password.
Pass-the-Hash
Authenticate to remote services using an NTLM hash directly, without cracking the plaintext password.
Pass the Ticket
Replay a stolen Kerberos ticket to reach a service without ever presenting the account password.
DPAPI Credential Theft
Decrypt DPAPI-protected blobs — browser passwords, RDP credentials, Wi-Fi keys — using the master key.
SMB / NTLM Relay
Redirect NTLM authentication to an attacker-controlled service and relay the challenge-response to a target.
Kerberos Delegation Abuse
Abuse constrained or unconstrained Kerberos delegation to capture or replay a user's TGT from a service.
Golden Ticket Attack
Forge a Kerberos Ticket Granting Ticket (TGT) using the krbtgt account password hash, granting persistent, domain-wide authentication that bypasses the KDC.
Silver Ticket
Forge a service ticket signed with the target service's key to reach one service without the KDC.
Kerberoasting
Request TGS tickets for service accounts and crack the RC4 or AES service key offline.
AS-REP Roasting
Request AS-REP messages for accounts with pre-authentication disabled and crack the encrypted timestamp offline.
Ccache File Theft
Steal a Kerberos credential cache file and replay its TGT or TGS without touching live process memory.
T1055WindowsT1057Windows, LinuxT1562.001Windows, Linux, macOST1562.001WindowsT1562.006WindowsT1622Windows, Linux, macOST1622Windows, Linux, macOS
Hunting Unbacked Executable Memory
The single highest-yield structural hunt across the whole injection category.
Memory Forensics with Volatility 3
Triage a memory image to find injected code, rogue processes, and hidden artefacts using Volatility 3.
Behavioral Analytics & UEBA
Detect attacker activity by identifying statistical deviations from baseline user and entity behaviour rather than matching known signatures.
Sysmon Deployment & Tuning
Deploy and tune Sysmon to generate high-fidelity process, network, and file events for threat hunting and incident response.
ETW Telemetry & ETW-TI
Understand what Event Tracing for Windows sees, what it misses, and how attackers try to blind it.
Writing Sigma Detection Rules
Author portable, high-signal Sigma rules that translate to any SIEM without rewriting per-platform.
YARA Memory Scanning
Write and deploy YARA rules that hunt for technique artefacts directly in process memory.