In-process runtimes

← maldev README · docs/index

In-process loaders that execute foreign code (BOFs, .NET assemblies, full Windows PEs) without spawning child processes. The implant becomes its own post-exploitation runtime — useful when child-process creation is heavily monitored.

Where to start (novice path):

1. bof — load a Cobalt-Strike-style BOF (small custom C-compiled gadget) in-process. Cheapest in-process post-ex runtime.
2. pe — run a full Windows EXE or DLL in-process via the embedded No-Consolation BOF, capture its stdout. Drop-in replacement for CreateProcess when operator tools ship as .exe.
3. clr — host the .NET CLR in-process to run Mimikatz / Seatbelt / SharpHound assemblies without spawning powershell.exe or dropping .exe to disk.

All three avoid child-process creation. Pair with evasion/preset so the runtime calls don't tip AMSI / ETW.

Packages

Quick decision tree

MITRE ATT&CK

See also

• Operator path: end-to-end chain
• Researcher path: how the CLR v2 activation chain works