Bypassing56 A hands-on guide to building a basic Windows EDR with a kernel driver, callbacks, static analysis, DLL injection, and hooks to detect…
APC58 The article walks through Windows malware development from dynamic API resolution and PEB walking to injection, APC execution, driver basics, DKOM process…
Bypassing444 COMouflage is a stealthy Windows injection technique that abuses COM DLL Surrogates to execute malicious DLLs inside dllhost.exe, making svchost.exe appear as…
EDR29 The article presents T(ROP)H, a process injection technique that hijacks threads and uses a ROP chain to load a DLL without allocating…
attaks26 How to implement Early Cascade Injection in Rust, a stealthy Windows process injection technique that hijacks shim engine callbacks in ntdll to…
Bypassing18 The article explains enhancing RPC Proxy Injection to evade Elastic EDR telemetry by avoiding common API calls like WriteProcessMemory and CreateRemoteThread, using…
Bypassing31 The article “Living off the Process” details a technique to inject and execute shellcode into a remote Windows process by reusing existing…
APC24 The EarlyBird APC technique creates a trusted process in a suspended state, allocates memory for shellcode, and writes the payload. It then…
A PoC/demo demonstrating code injection via COM (using the IRundown::DoCallback() mechanism) to execute a payload in the context of a selected process, including lsass.exe (or any…
alloc14 Remote process injection and looking for a few under-the-radar techniques that were either not documented well and/or contained minimalist core requirements for…
cpp38 Red team technique—process injection—and how to leverage it against Protected Process Light (PPL)
Injection35 In this article, I will demonstrate one of the classic, fundamental techniques for injecting shellcode into a remote process using APCs. I…
