MALOCT 3114m
Unhooking ntdll: removing EDR's eyes
How userland hooks work, how to remove them, and why the technique is less effective than the blogs suggest.
- #EDREvasion
- #Unhooking
- #ntdll
IndexAll entries
newest first.
Loaders, sleep obfuscation, and the engineering trade-offs behind implants. Built to understand, not to ship.
CVE ROOT CAUSE◆IMPLANT ENGINEERING◆AD ATTACK PATHS◆DETECTION FIRST◆LAB-DERIVED ONLY◆NO CLIENT DATA◆CVE ROOT CAUSE◆IMPLANT ENGINEERING◆AD ATTACK PATHS◆DETECTION FIRST◆LAB-DERIVED ONLY◆NO CLIENT DATA◆
Malware Development
Loaders, sleep obfuscation, and the engineering trade-offs behind implants. Built to understand, not to ship.
MALOCT 3017m
Process injection, end to end
Classic injection, APC injection, and process hollowing with working code, compile commands, and the detection surface for each.
- #ProcessInjection
- #APC
- #Hollowing
MALOCT 2915m
Advanced static AV bypass: from signature to silence
A field manual for making a PE invisible to static scanners: entropy, section names, API hashing, string obfuscation, and the compile flags that matter.
- #AVEvasion
- #StaticAnalysis
- #PE
MALOCT 1216m
Sleep obfuscation, from first principles
Ekko, Foliage, and timer-queue sleep obfuscation compared under the same memory scanner. The writeup is the thesis; the harness is proof.
- #SleepObfuscation
- #Ekko
- #Foliage
MALSEP 0518m
PE loader from scratch
Writing a minimal PE loader to understand how Windows maps and executes binaries, and where detection can land.
- #PE
- #Loader
- #Windows
MALAUG 2810m
Indirect syscalls are not a personality
Why indirect syscalls buy less than people think, and what the detection side actually keys on.
- #Syscalls
- #EDREvasion
- #Detection
No index is complete without the next one.
The dispatch carries one long-form writeup, roughly twice a month. Same standard, same lab, no drip feed.