boto@redteam:~/blog/malice/part-00-why-malware-dev$

cd .. Blog

Malice : Why Malware Development?

part 0intro

Introduction

This series will explore the world of malware development from the perspective of a red team operator. We’ll dive into the techniques and tools used to create and deploy malware, and how defenders can detect and mitigate these threats.

The goal of this series is not to make you a malicious actor, but to provide a comprehensive understanding of malware development for better adversary simulation and emulation. By understanding how malware works, defenders can better protect their systems and networks. And for the red teamer, it provides a deeper understanding of the techniques and tactics used by real-world adversaries along with the methods used to evade detection by AV and EDRs.

Ground rules

  • Everything is built and tested in an isolated lab.
  • Each part explains the technique, how it works, and how a defender can see it.

Starting Roadmap

  1. Getting started with the win32 API, a simple message box program.
  2. Shellcode injection.
  3. DLL injection.
  4. Self-injection via Fibers.

Obviously, this is just a starting point. The series will evolve as we explore more advanced techniques and tactics used by real-world adversaries. The above roadmap is just the beginning of our journey into the world of malware development. Each part will build upon the previous one, providing a better understanding of the techniques used by red team operators and real-world adversaries.