Skip to content
λmaldev wiki/
pagesBlue Team & Detection

Blue Team & Detection

The other half of the wiki, read on its own: rule-writing craft, memory forensics workflow, and what each telemetry source can and cannot see.

1 techniques
T1055
Hunting Unbacked Executable Memory
The single highest-yield structural hunt across the whole injection category.