A defensive reference for understanding behaviors commonly observed during malware analysis. The repository organizes conceptual examples by MITRE ATT&CK technique so analysts can connect implementation patterns with detection and investigation guidance.
Caution
This repository is for educational and defensive research only. Use an isolated, network-segmented lab such as FLARE-VM or REMnux. Never test unknown code or samples on production systems.
- Explain adversary behaviors from a defender's perspective.
- Map examples to public MITRE ATT&CK techniques and sub-techniques.
- Highlight useful telemetry, investigation questions, and mitigations.
- Keep content navigable for SOC, DFIR, reverse-engineering, and security students.
This repository is not intended to provide deployable malware, exploits, payloads, command-and-control infrastructure, or evasion tooling.
| ATT&CK technique | Topic | Content |
|---|---|---|
| T1547 | Boot or Logon Autostart Execution | Overview |
Content follows this convention:
T####/ ATT&CK technique
└── ###/ Sub-technique identifier
├── README.md Defensive analysis notes
└── <example files>
- SOC analysts and incident responders
- Malware reverse engineers and DFIR practitioners
- Security researchers and students working in controlled labs
The maintainers do not condone or support creating, deploying, or distributing malicious software. Use this material responsibly and in accordance with applicable laws, organizational policies, and authorization boundaries.
Licensed under the MIT License.