In-process runtimes

← maldev README · docs/index

In-process loaders that execute foreign code (BOFs, .NET assemblies) without spawning child processes. The implant becomes its own post-exploitation runtime — useful when child-process creation is heavily monitored.

Packages

Quick decision tree

MITRE ATT&CK

See also

• Operator path: end-to-end chain
• Researcher path: how the CLR v2 activation chain works