Adversary research
Adversary-side work on how modern malware hides from the controls we rely on. Full write-ups live on the research subdomain. The sanitized case-file version is here.
The through-line is the same question in different forms: what does the adversary actually do, observed rather than assumed, and what should defenders change once they know?
Scope
The Master's research took three live malware families apart in an isolated lab and
mapped every observed behaviour to MITRE ATT&CK, including an
obfuscated loader that patches amsi.dll in memory to blind AMSI before
the payload runs.
Ongoing notes cover evasion tradecraft and the detection engineering that answers it.
- Families
- 3Redline Stealer, WannaCry, SheetRAT
- Techniques
- 30Observed, then mapped to ATT&CK
- Tactics
- 10Execution through to impact
Published work
- Decoding malicious camouflage Case file CF-001
- Threat-intelligence reports Extracted and enriched IOC sets
- Evasion and detection notes Ongoing
Full write-ups live at research.lloydsato.com.