maldev-links - My collection of malware dev links

项目说明

redteam/malde

Massi to for fixing my trash formatting and categorizing it. Now it wont give you eye cancer.
I sometimes put stuff on my blog. Existing research I read and find useful will be put here.

For dead or redirected links, try the wayback machine :D

Smartscreen and MOTW

What is it that makes a Microsoft executable a Microsoft executable? ⚠️ REDIRECTED!

The Case of the Missing Digital Signatures Tab

Defender SmartScreen Deep Dive 02

Hooking/unhooking

* Lets Create An EDR… And Bypass It! Part 1: How EDRs inject DLLs to hook processes
* Lets Create An EDR… And Bypass It! Part 2: Pre the hook from loading into our process by pre the DLL load
* Userland DLL hooks C# code sample - SharpUnhooker
* E userland DLL hooks in C# using D/Invoke - D-Pwn
* Ad in Dynamic E; unhooking ⚠️ REDIRECTED!
* Kernel callbacks
* Process instrumentation callbacks
* Hooking
* E EDR Detection with Reentrancy Abuse
* Unhooking Sentinel1 ⚠️ REDIRECTED!
* Emulating Covert Operations - Dynamic In (A PInvoke & API Hooks)
* Halo's Gate: Dynamically resolving syscalls based on unhooked syscalls
* Shellcode detection using realtime kernel monitoring
* EDR tampering 💀 DEAD LINK!
* Offensive API Hooking

AMSI/ETW/ETW-TI

* Proxying DLL Loads for hiding ETW-TI call stack tracing
* E ETW-TI call stack tracing using custom call stacks
* Attacks on ETW Blind EDR Sensors
* Detecting Ad Tradecrafts Tools by le ETW
* Data Only Attack: Neutralizing EtwTi Provider 💀 DEAD LINK!

Sleep obfuscation/masking

* Stack Spoofing
* SleepyCrypt: Encrypting a running PE image while it sleeps
* Sleeping with a Mask On (Cobalt Strike)
* GPUSleep
* SilentMoonWalk - a thread stack spoofer
* CallStackMasker
* Reflective Call Stack Detections and E
* Behind the Mask: Spoofing Call Stacks Dynamically with Timers
* Ad module stoping using AceLdr
* Draugr - synthetic stack frame
* Cronos - sleep obf based on ekko
* KrakenMask - APC and gadgets for sleep obf
* Shelter - ROP sleep obf (another one)
* B21 - using Tp* WinAPIs to have a clean callstack while sleeping
* Pendulum - linux sleep obf
* PhaseDive - of Ekko
* Sleep obf explained

Rootkits

* Bootlicker - UEFI rootkit 💀 DEAD LINK!
* Niddhogg - kernel dri

VBA

* VBA: resolving exports in runtime without NtQueryInformationProcess or GetProcAddress

Direct syscalls

* SysWhispers is dead, long li!
* Combining Direct System Calls and sRDI to bypass AV/EDR ⚠️ REDIRECTED!
* Implementing Syscalls in Cobalt Strike Part 1 - Battling Imports and Dependencies
* When You sysWhisper Loud Enough for AV to Hear You

Process injection

* Process injection sample codes
* KnownDLLs injection
* Abusing Windows’ Implementation of Fork() for Stealthy Memory Operations
* Object O
* HintInject
* APC techniques
* Unicode Reflection - Event Null Byte Injection
* Alternati Injection
* Weaponizing mapping injection
* Ad-Workshop by CyberWarFare Labs
* Threadless inject
* Function hijacking
* Mockingjay (Reusing existing RWX memory) techniques

General e/Execution techs

* Operational challenges in offensive C - SpectreOps ⚠️ REDIRECTED!
* WORKSHOP // A journey into malicious code tradecraft for Windows // Silvio La Porta and Antonio
* Python library for ML e and detection etc
* Massi on bypassing anticheat and antidebug - also works in malware against EDRs 💀 DEAD LINK!
* 3in1: Project aimed to Bypass Some A, Using Different, Ad Features ⚠️ REDIRECTED!
* E: Different e techniques/PoCs
* Reading and writing remote process data without using ReadProcessMemory / WriteProcessMemory 💀 DEAD LINK!
* SharpEDRChecker: EDR detection
* StackScraper - Capturing sensitive data using real-time stack scanning against a remote process 💀 DEAD LINK!
* WindowsNoExec - Abusing existing instructions to executing arbitrary code without allocating executable memory 💀 DEAD LINK!
* Masking Malicious Memory Artifacts – Part III: Bypassing Defensi
* EDR and Blending In: How Attackers Avoid Getting Caught: Part 2
* Ad in Dynamic E ⚠️ REDIRECTED!
* Hindering Threat Hunting, a tale of e in a restricted en
* One thousand and one ways to copy your shellcode to memory ()
* Delete-self-poc: A way to delete a locked, or current running executable, on disk
* Writing Beacon Object Files: Flexible, Stealthy, and Compatible: Direct syscalls from the real ntdll to bypas syscall detection 💀 DEAD LINK!
* Kernel Karnage – Part 9 (Finishing Touches)
* Using the kernel callback table to execute code ⚠️ REDIRECTED!
* In Sandbox E
* Important: Reduce ur entropy ⚠️ REDIRECTED!
* compile your code into mo
* Perfect DLL Hijacking
* E Elastic Callstack Signatures

Operational stuff - OPSEC, TTPs, etc.

* Life of a payload
* PPLMedic
* Parent-child process strcuture 💀 DEAD LINK!
* Echotrail - windows process stats ⚠️ REDIRECTED! <-- this is now down, it leads to some weird coworking space service
* Browser In The Browser (BITB) Attack 💀 DEAD LINK!
* Black Hills Infosec - Coercion and relays
* Pocket Guide to OPSEC in Ad Emulationq

Campaign/Operation analysis

* Obser from the stellarparticle-campaign ⚠️ REDIRECTED!
* Ukraine Cyber Operations
* Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” #threatintel report ⚠️ REDIRECTED!
* Post auth RCE based in malicious LUA plugin script upload SCADA controllers located in Russia 💀 DEAD LINK!
* Does This Look Infected? A Summary of APT41 Targeting U.S. State Go ⚠️ REDIRECTED!

Phishing

* Re Phishing Simulations ⚠️ REDIRECTED!
* Phishing page detection classifiers from page layout feature ⚠️ REDIRECTED!
* List of crowd-sourced phishing sites. Some are still active
* mrd0x - phishing with spoofed cloud attachments 💀 DEAD LINK!
* mrd0x - teams abuse 💀 DEAD LINK!
* mrd0x - phishing with .ics 💀 DEAD LINK!
* Phishing with Github ⚠️ REDIRECTED!

Acti

* A comprehensi on relaying
* Automating a Red Team Lab (Part 1): Domain Creation
* Automating a Red Team Lab (Part 2): Monitoring and Logging
* Announcing Azure in BloodHound Enterprise ⚠️ REDIRECTED!
* AD Trusts 💀 DEAD LINK!
* Learn AD basics 💀 DEAD LINK!
* Diamond attacks
* Certified Pre Owned (ADCS Abuse) ⚠️ REDIRECTED!

Initial Access

* How to Deli in an Enterprise Attack with Ste

Windows Logon and Credential Security

* Windows Logon Process Deep Dive ⚠️ REDIRECTED!
* How to Detect and Dump Credentials from the Windows Registry
* DPAPI Deep Dive
* Mimikatz SSP for Stealing Credentials at Logon
* Kerberos Authentication Deep Dive 💀 DEAD LINK!
* Process Integrity Levels
* Protected Processes in Windows (LSASS as a PPL)
* Mimikatz WDigest (Storing Plaintext Credentials in Memory)
* Credential Defenses ⚠️ REDIRECTED!
* Defeating Windows Defender Credential Guard 💀 DEAD LINK!
* NTLM and NTLMv2 Challenge-Response 💀 DEAD LINK!
* Net-NTLMv1 Deprecation and Rainbow Tables

Persistence

* SharpE
* Persistence – Notepad++ Plugins

OSINT

* Nrich: Cli tool to quickly analyze all IPs in a file and see which ones have open ports/

Tools

* in memory lsass dumper using syscalls ⚠️ REDIRECTED!
* Walter Planner: Attack path planner
* NimPackt-v1: A Nim-based packer for .NET executables and raw shellcode
* PackMyPayload: Payload Containerization
* TymSpecial Shellcode Loader 💀 DEAD LINK!
* KrbRelay
* BadAssMacros: generate malicious macros
* PurplePanda: Identify pri escalation paths and dangerous permissions
* 0d1n: a tool for automating customized attacks against web applications 💀 DEAD LINK!
* Inceptor: a tool which can help to automate AV/EDR bypass
* Injector: Complete Arsenal of Memory injection and other techniques for red-teaming in Windows 💀 DEAD LINK!
* Pixload: Set of tools for creating/injecting payload into images ⚠️ REDIRECTED!
* Cloak: Generate python payloads and inject them into python scripts
* SNOWCRASH: Create a scripts that can be launched on both Linux and Windows machines
* D-Generate - syscall tracing ⚠️ REDIRECTED!
* Crystal-Kit

Rootkits

* Lord of the ring0

contents

* Myths-About-External-C2
* Running shellcode in electron 💀 DEAD LINK!
* Cause & Effect…ive C2 ⚠️ REDIRECTED!
* Eye of the TIBER - A blend of red team trends
* Useful Libraries for Malware De
* [Windows E [200 E]]()
* Russian Cyber Attack Escalation in Ukraine
* A Study on Blue Team’s OPSEC Failures ⚠️ REDIRECTED!
* Dive into the MITRE Engage™ Official Release 💀 DEAD LINK!
* Conti leaked chats
* Conti source code
* Attack Flow — Beyond Atomic Behaviors 💀 DEAD LINK!
* VBA and Function Pointers 💀 DEAD LINK!
* MalAPI: List of Windows Apis classified by usage in malware dev
* Guest Diary (Etay Nir) Kernel Hooking Basics ⚠️ REDIRECTED!
* BOF2shellcode — a tutorial con a stand-alone BOF loader into shellcode 💀 DEAD LINK!
* BOF Cocktails
* How to Hide Beacon During BOF Execution
* Cobalt Strike User Defined Reflecti (UDRL)
* DynamicWrapperEx – Windows API In from Windows Script Host ⚠️ REDIRECTED!
* Cracked5pider/ReflectedDll.c: Get output from injected reflected dll
* Nt/Zw Mapping from Kernel32
* DEF CON 29 - Ben Kurtz - Offensi Bonanza: Writing Golang Malware
* A no to communicate between threads using the standard ETHREAD structure
* Black Mass 2022
* Tradecraft Garden - by raphael mudge

Azure related:

* Cloud Adoption Framework for Azure Terraform landing zones
* March 2022 Update Release Notes: Cloud Adoption Framework for Azure Terraform landing zones
* Cloud Adoption Framework for Azure Terraform landing zones Documentation
* Cloud Adoption Framework for Azure - Landing zones on Terraform - Rover

C2 related:

* Counter Strike 1.6 as Malware C2
* Offensi
* We Put A C2 In Your Notetaking App: Offensi 💀 DEAD LINK!
* Building C2 implants in C++
* C2 matrix - all your c2 needs here
* How GitLab's Red Team automates C2 testing ⚠️ REDIRECTED!
* Playing in the Tradecraft Garden of Beacon 💀 DEAD LINK!
* Defining Cobalt Strike Reflecti

Blue Team - how we get burnt

* 72-page eBook describing Endgame’s solution to hunting ad cyberthreats ⚠️ REDIRECTED!
* TiEtwAgent – ETW-based process injection detection (cant unhook from userland) ⚠️ REDIRECTED!
* Detection Engineering
* How I met your beacon (MDSec x33fcon talk)

项目信息

开发语言：Python

Star 数：327

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕My collection of malware dev links展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。