asm-offensive-patterns

High security risk: this skill is explicitly focused on offensive assembly and supplies detailed implementation guidance for shellcode, process injection, stealth, and EDR evasion. The provided material does not show credential theft, exfiltration, malicious pre-execution, or an install/download chain, so malicious intent is not confirmed.

This is documentation for a dual-use WoW64 technique that switches execution modes and describes bypassing 32-bit AV/EDR hooks to reach 64-bit ntdll and native syscalls. It also suggests disguising a known selector signature, but the fragment itself contains no executable package behavior, data theft, persistence, or destructive action. The content presents a moderate security concern because it enables evasion, while malware intent or execution is not established; severity is moderate.

This excerpt is a technical guide to syscall resolution and dispatch, with explicit methods for evading endpoint monitoring through indirect syscalls, randomized gadgets, clean ntdll mappings, VEH/hardware breakpoints, and call-stack manipulation. Those techniques are dual-use but materially support stealthy malware behavior; the shown text does not itself implement a payload, data theft, persistence, or network communication. No domains, URLs, IP addresses, or targeted credentials are present. Security risk is elevated due to the evasion-focused content, while malware intent cannot be established from this excerpt alone.

This excerpt documents shellcode metamorphism and byte decoding, with explicit aims of defeating pattern scanning through instruction rewriting, junk bytes, opaque predicates, and altered hashes. These are significant malware-evasion indicators, but no executable deployment, unauthorized execution, data theft, network activity, or persistence is demonstrated in the excerpt. Severity is elevated because the techniques enable evasion and shellcode concealment; the shown content alone does not confirm an active malware payload.

This fragment is an instructional guide, not executable malware, and contains no active network, filesystem, or process operations as shown. It gives detailed, actionable methods for shellcode decoding and execution, process/DLL hollowing, sandbox detection, and EDR/ETW evasion, making the content high risk for misuse. No actual payload, credentials, or command-and-control endpoint is shown; the referenced URL is www[.]offsec[.]com. The visible content is not obfuscated, but its operational guidance warrants a high security-risk rating.

This fragment is documentation, not an automatically executing package component. It provides shell-spawning syscall examples and guidance on indirect syscalls and EDR monitoring, which could support offensive use if adapted and executed. No credential theft, exfiltration, persistence, or system damage is shown; severity is moderate due to the actionable shellcode and evasion context.

This fragment is a non-executable guide to Windows EDR evasion through call-stack spoofing and related techniques, including VEH/debug-register use and call-gadget insertion. It contains no implemented data theft, persistence, network activity, or system modification, so malware presence is not established. The material is nevertheless actionable defense-evasion guidance and presents a security concern; cited domains are whiteknightlabs[.]com and github[.]com/WKL-Sec/LayeredSyscall.

The code is a shellcode/PIC technique reference with several capabilities commonly used in offensive tooling, particularly staged payload discovery and API-resolution concealment. It contains no demonstrated malicious payload or unauthorized system action, so malware intent is not established. Its presence in an otherwise unrelated package would warrant strong provenance and context review because the techniques can support stealthy code injection.

The fragment is documentation for advanced process-injection and shellcode-execution techniques with clear offensive and evasion use. It is not itself executable malware and contains no demonstrated data theft or system compromise, but the techniques described can enable stealthy unauthorized code execution and warrant restricted handling.