What is this?
Workshop materials from DEF CON 34 and BSidesLV 2026 on writing custom malware that evades EDR — from loaders to kernel-level techniques.
Workshop materials from DEF CON 34 and BSidesLV 2026 on writing custom malware that evades EDR — from loaders to kernel-level techniques.Is this a tool I can run, or course materials?Course materials, not software. The repo holds Markdown reference versions of the workshop content; the live sessions were slide-based presentations.
Course materials, not software. The repo holds Markdown reference versions of the workshop content; the live sessions were slide-based presentations.So how do I actually use it?Read the Markdown files in the Reference directory — nothing to build or install. Note they are reference-only and were not thoroughly reviewed or updated.
Read the Markdown files in the Reference directory — nothing to build or install. Note they are reference-only and were not thoroughly reviewed or updated.Do the demonstrations target a specific EDR?The techniques were demonstrated against Elastic Defend as the target EDR, and the C2 section covers customizing the Havoc framework.
The techniques were demonstrated against Elastic Defend as the target EDR, and the C2 section covers customizing the Havoc framework.Is the workshop's source code included?No — source code was shared only with workshop participants. The author says it may be made public if there is sufficient interest.
No — source code was shared only with workshop participants. The author says it may be made public if there is sufficient interest.Is it OK to actually use these techniques on real machines?No. The author restricts the material to educational and security research purposes and asks readers not to apply it to malicious or unauthorized activity.
No. The author restricts the material to educational and security research purposes and asks readers not to apply it to malicious or unauthorized activity.What is Havoc?Havoc is a command-and-control (C2) framework; the workshop dedicates a section to customizing it as part of the evasion chain.
Havoc is a command-and-control (C2) framework; the workshop dedicates a section to customizing it as part of the evasion chain.Do the techniques transfer to other EDR products?The workshops only targeted Elastic Defend; the README makes no claims about how the techniques fare against other EDRs.
The workshops only targeted Elastic Defend; the README makes no claims about how the techniques fare against other EDRs.What are similar projects?bug-bounty-hunting-prompts, Decepticon, Claude-Red, Red-Teaming-Toolkit, CVE-2026-62911, exploitarium, Claude-AD, Relapse-Exploit
bug-bounty-hunting-prompts, Decepticon, Claude-Red, Red-Teaming-Toolkit, CVE-2026-62911, exploitarium, Claude-AD, Relapse-ExploitWhich topics is it in?command-and-control, security-research, english, kernel, offensive-security, red-team, low-level, pentesting, penetration-testing, hacking, cybersecurity, reference
command-and-control, security-research, english, kernel, offensive-security, red-team, low-level, pentesting, penetration-testing, hacking, cybersecurity, reference