For detection engineers (blue team)

← maldev README · docs/index

Every technique here has been measured against EDR / Defender / event logs. This page lists the artifacts each leaves behind, where to look, and which D3FEND counter-technique applies. Use it to write detections, plan red-team exercises, or harden endpoints.

TL;DR

[!TIP] If your goal is "what should I monitor first", focus on the noisy / very-noisy rows in the Detection Difficulty table below. Those are the techniques where the trade-off is worst for the attacker — easiest wins for the defender.

Detection difficulty matrix

Every package is annotated with a Detection level field in its doc.go. Buckets:

cmd/docgen (Phase 3 of the doc refactor) produces a flat table of all public packages by detection level. Until then, see each package's doc.go.

Per-area detection guidance

Syscalls — win/syscall

[!NOTE] ETW Threat Intelligence provider (Microsoft-Windows-Threat-Intelligence) emits EVENT_TI_NTPROTECT and EVENT_TI_NTALLOCATEVIRTUAL regardless of whether the call came from ntdll or a direct syscall instruction. Subscribing to TI events is the single best detection investment for this area.

AMSI / ETW patching — evasion/amsi, evasion/etw

Hunt query (KQL pseudo-code):

DeviceImageLoadEvents
| where FileName == "amsi.dll"
| join DeviceProcessEvents on InitiatingProcessId
| project ProcessName, AmsiBytes = read 3 bytes at AmsiScanBuffer offset
| where AmsiBytes != original_bytes

D3FEND counters: D3-PSM (Process Spawn Monitoring), D3-PMC (Process Module Code Manipulation Detection). Hardening: **AMSI Provider DLL pinned

• signed**.

ntdll unhooking — evasion/unhook

Hunt: memory-scan ntdll RX section for stubs that diverge from on-disk bytes after the EDR's hook installer ran.

Sleep masking — evasion/sleepmask

D3FEND: D3-PSEP (Process Self-Modification). Hardening: kernel thread-stack walking on a 5–30 second cadence.

Injection — inject

Per-method telemetry (excerpt; full table per technique page):

See docs/techniques/injection/ for the per-method artifact list.

Credential access — credentials/*

Hardening: Credential Guard (LSASS in VTL1) defeats lsassdump write/read; Protected Process Light (PPL) requires the BYOVD unprotect path which is itself detectable via signed-driver provenance events (Sysmon Event 6).

Persistence — persistence/*

D3FEND: D3-RAPA (Resource Access Pattern Analysis), D3-PFV (Persistent File Volume Inspection).

Cleanup — cleanup/*

The most-overlooked area for blue. Cleanup deliberately removes artifacts the rest of the chain would have left.

Forensic detection: MFT inconsistency between $STANDARD_INFORMATION and $FILE_NAME timestamps is the canonical timestomp tell.

Hardening recommendations

1. Enable ETW Threat Intelligence provider and ship its events to your SIEM. Single highest-leverage signal for this entire library.
2. Credential Guard + LSASS in PPL (kernel RunAsPPL=1).
3. WDAC / AppLocker with publisher allow-list — defeats Donut-loaded PE shellcode if PE policy applies (depends on AMSI integration).
4. Sysmon with SwiftOnSecurity baseline covers most artifact categories above.
5. Driver block-list policy — Microsoft's vulnerable driver block list includes RTCore64; enable it.

Hunt repository (placeholder)

[!NOTE] A docs/hunts/ directory with Sigma rules and KQL queries per technique is on the Phase 5 roadmap. Until then, the per-technique "OPSEC & Detection" sections (mandatory by doc-conventions) carry the hunt-relevant artefacts.

Where to next

• Researcher path — same techniques explained from the attacker design angle.
• Operator path — see how the chain composes; useful for red-team / purple-team coordination.
• MITRE map — full ATT&CK / D3FEND reconciliation.
• docs/techniques/ — drill into any specific technique.