Wiki - Windows Security Attack & Defense Guide

Chapters

100+

Techniques

200+

Code Examples

This guide covers both offensive techniques (red team) and defensive perspectives (blue team/EDR detection). Each chapter includes working code examples, detection strategies, and MITRE ATT&CK references.

Core Chapters

Boot Security

UEFI, Secure Boot, Bootkits, Measured Boot, firmware-level attacks and defenses.

Kernel Security

DSE, PatchGuard, HVCI, BYOVD attacks, Kernel Patch Protection mechanisms.

Early Initialization

LSA Protection, ETW-TI, ELAM drivers, Protected Process Light (PPL).

User Session

Winlogon, Credentials, Kerberos, NTLM authentication mechanisms.

Memory Protection

DEP, ASLR, CFG, CET, Stack Canaries, memory safety mechanisms.

API & EDR Evasion

Hooks, Direct Syscalls, Unhooking techniques, Hell's Gate, Halo's Gate.

AMSI & ETW Bypass

AMSI Patching, ETW Patching, Hardware Breakpoint techniques.

Sleep & Memory Evasion

Ekko, Foliage, Heap Encryption, sleep obfuscation techniques.

Persistence Mechanisms

Registry, COM hijacking, TypeLib, CLR, Services persistence.

Modern Techniques

2024-2025 state of the art, latest evasion and detection methods.

Advanced Techniques

Payload Obfuscation

MAC, UUID, IPv4, IPv6 encoding/decoding for shellcode obfuscation.

Payload Staging

HTTP/S, DNS TXT, Registry, WMI, Named Pipes staging techniques.

Process Injection

DLL Injection, Shellcode Injection, Mapping, Process Hollowing.

Thread Hijacking & APC

Thread Hijacking, APC Injection, Early Bird technique.

Anti-Analysis

Anti-Debug, Anti-VM, Anti-Sandbox, Timing-based detection evasion.

IAT Hiding & API Hashing

PEB Walking, DJB2, Jenkins, Compile-Time Hashing techniques.

API Hooking

Inline Hooks, Detours, MinHook, IAT/EAT, VEH-based hooking.

Binary Obfuscation

Entropy Reduction, Packing, Code Signing, static analysis evasion.

Callstack Spoofing

Synthetic Frames, RBP Chains, RUNTIME_FUNCTION manipulation.

Block DLL Policy

Process Mitigation, EDR Evasion, Application Hardening.

Windows SecurityAttack & Defense Guide