Instead of walking through shellcode generation, this post explains how shellcode executes, why it is position independent, and what that means in practice.

Instead of walking through shellcode generation, this post explains how shellcode executes, why it is position independent, and what that means in practice.

Instead of walking through shellcode generation, this post explains how shellcode executes, why it is position independent, and what that means in practice.

This proof-of-concept explores NSIS plugin DLL proxying using a legitimate NSIS-based installer to study DLL loading behavior during installation. It demonstrates how the transient `ns*.tmp` extraction stage can be leveraged to evaluate security telemetry, time-of-check/time-of-use (TOCTOU) scenarios, and detection coverage while preserving the installer’s normal execution flow through export forwarding.

Stop using print-only simulators. This free script emulates real ransomware TTPs – shadow copies, process kills, encryption – and rolls back cleanly. Test your EDR today.

Author: Valli-Nayagam Chokkalingam Contents Introduction Not every infection chain worth studying is new. Some of the most instructive ones are simply well-built — stable, repeatable, and grounded in real attacker tradecraft. The campaign analyzed here comes from a slightly older AveMaria distribution wave documented by Zscaler ThreatLabz, where attackers relied on a staged delivery path…

Author: Valli-Nayagam Chokkalingam Contents The Algorithm Is Not the Detection In Part 1, everything lived inside custom packer logic: not “malware strings,” not obvious config blobs—just the boring reality of a loader trying to stay unreadable. High entropy, dead strings, and a small decryptor sitting in the middle like a locked door. Part 2 stays…

Author: Valli-Nayagam Chokkalingam Most YARA rules start with strings. This post looks at what’s left when strings disappear—and how detection shifts closer to execution itself. The focus here is on how YARA rules are reasoned about, not to provide production-ready signatures or drop-in detection rules. Contents What YARA Is (and What It Isn’t) YARA is…