Skill UI

A comprehensive guide and methodology for detecting process hollowing (T1055.012). It involves advanced memory forensics, analyzing memory-mapped sections, and correlating parent-child process anomalies using EDR and Sysmon data to identify fileless and in-memory malware threats.

A comprehensive skill for detecting advanced malware techniques, including DLL injection, process hollowing, APC injection, and thread hijacking. Utilizes memory forensics (Volatility), API monitoring (Sysmon), and behavioral analysis to identify malicious code artifacts and suspicious process activities in a deep defense context.

A comprehensive playbook detailing advanced techniques for bypassing modern Endpoint Detection and Response (EDR) and Antivirus (AV) solutions on Windows. Covers exploiting vulnerabilities in AMSI, ETW, and implementing sophisticated process injection methods (e.g., Process Hollowing, Early Bird) to execute payloads while maintaining stealth.