Windows Malware Development for Red Teamers [2/2026, ENG]

Обучающие видео » Компьютерные видеоуроки и обучающие интерактивные DVD » Компьютерные сети и безопасность

Windows Malware Development for Red Teamers

Год выпуска: 2/2026
Производитель: Udemy
Сайт производителя: https://www.udemy.com/course/windows-malware-development-for-red-teamers/
Автор: B Karthik
Продолжительность: 2h 38m
Тип раздаваемого материала: Видеоурок
Язык: Английский
Описание: This practical Windows malware development course focuses on execution techniques and internal system behavior from a red team perspective, teaching how malware controls execution flow inside Windows and how these techniques are implemented at a low level in real programs. It begins with Early Bird APC execution, where you develop code that executes during thread initialization using Asynchronous Procedure Calls, building the technique step by step in a controlled lab environment. Next, you implement direct system calls using x64 assembly, learning how malware communicates directly with the Windows kernel and how to invoke native system calls without relying on higher-level APIs.

The course then covers additional execution techniques including TLS callback execution, timer queue callbacks, and code cave injection, with working implementations to show how they affect process behavior and execution flow. You also develop and use exception-based techniques such as Vectored Exception Handling (VEH), Structured Exception Handling (SEH), and Unhandled Exception Filters (UEF) to control execution flow inside a process and demonstrate how exception handling can be leveraged in malware development. The course is intended for red teamers, security researchers, and learners who want hands-on experience building and understanding Windows malware execution techniques, with all demonstrations performed in an isolated lab environment for educational and research purposes only. By the end, you will understand how these techniques are designed, implemented, and structured at a low level, and how Windows internals can be used to control and influence program execution.
[spoiler="Содержание"]
1 - Introduction
1. Introduction (01:22)
2. Generating Raw Payload Byte Arrays Using msfvenom (01:27)

2 - Early Bird APC Injection
3. APC Early Execution – Overview (04:36)
4. Implementing Early Bird APC Injection (15:32)
5. Early Bird APC Injection – Execution (01:08)

3 - Direct System Call Technique
6. Direct System Calls – Concept (03:46)
7. Implementing Direct Syscalls in Assembly (07:11)
8. Integrating Syscalls into the Main Application (11:57)
9. Program Execution & Code Walkthrough (04:54)

4 - Timer Queue Code Execution
10. Timer Queue Execution – Introduction (03:43)
11. Implementing Timer Queue Execution (18:35)
12. Timer Queue Execution (03:51)

5 - TLS Callback Injection
13. TLS Callback Injection – Introduction (02:47)
14. TLS Callback Structure in PE (winnt.h Analysis) (03:03)
15. Implementing TLS Callback Injection (14:21)
16. TLS Callback Execution (02:07)

6 - Code Cave Injection
17. Introduction to the Code Cave Injection Technique (01:43)
18. Embedding Custom Payloads into Code Caves (17:31)
19. Testing Code Cave Execution (03:22)

7 - VEH-Based Execution Technique
20. Introduction to Vectored Exception Handling (03:24)
21. Implementing Vectored Exception Handling (Part 1) (08:55)
22. Implementing Vectored Exception Handling (Part 2) (03:52)
23. Vectored Exception Handling – Execution (02:36)

8 - Structured Exception Handler (SEH) Manipulation
24. Structured Exception Handling (SEH) – Introduction (01:09)
25. Implementing Structured Exception Handling (05:27)
26. SEH Execution (01:21)

9 - Unhandled Exception Filter (UEF) Execution
27. Unhandled Exception Filter (UEF) – Overview (02:55)
28. Implementing Unhandled Exception Filter (04:01)
29. UEF Execution (01:44)
[/spoiler]
Файлы примеров: не предусмотрены
Формат видео: MP4
Видео: AVC, 1920x1080, 16:9, 30fps, 657kbps
Аудио: AAC, 48.0Hz, 192kbps, stereo
[spoiler="Скриншоты"]

[/spoiler]