This is a curated list of offensive security / malware development links to tutorials, writeups, and tools. It is representative of the offsec development of the last few years (around 2022 to 2026). The focus is mostly new-age initial access for redteamers against EDR's using C2. To be used with AI.
- Links by topic in .txt
- Links mirror & AI summary
.mdand.htmlare wegpage copy.jsonis wegpage metadata.llmis generated AI summary based on the .md
- Link mirror as ZIP to be used for AI re/search
This is mostly to be used with AI, NotebookLM style (see chapter below).
Example Link: blog.deeb.ch/posts/how-edr-works/
Link pointing to a Github is 404? Check the mirr0r
- Shellcode loader
- process injection techniques
- in/direct syscalls
- callstack obfuscation
- general windows api / memory basics
- (reflective) DLL loading & sideloading
- General anti-EDR (no edr killing) / anti-detection
- executing shellcode stealthily
- BIG
- Develop or analyse a EDR
- ETW, kernel callbacks, process hooking / ntdll hooking
- EDR architecture
- For RedEdr mostly
- Now for EDR reversing, EDR introspection
Static Analysis links/pages/zip:
- static analysis
- obfuscation
- anti virus scanner / AV
- PE
AMSI / ETW-patch / .NET / Powershell links/pages/zip:
- Disable AMSI to run .NET or powershell
- .net/powershell tooling
- .net/powershell obfuscation
Vulnerable Drivers links/pages/zip:
- BYOVD
- Finding, analysing and exploiting (vulnerable) drivers
- Bit of kernel exploitation
Crystal Palace & Stardust links/pages/zip:
- Crystal Palace & Stardust
- Very new MalDev style
- PIC compiling and loading
- AMSI bypass, AMSI patching
- Disable AMSI to run .NET or powershell
- .net/powershell tooling
- .net/powershell obfuscation
- maybe ETW patching
- Some C2 stuff
- BOF's
- Some EDR blocking
- Other unrelated things
- Not: Lateral movement
- Not: COM/DCOM mischief
- Not a complete list, not curated
- Dumping LSASS
- Maybe other credential dumping
- Not a complete list, not curated
- Some random Windows COM things
- Not curated a lot
- Defender Docs mostly
- Not actively maintained, see
EdrDev
The links are mostly collected from nonpublic Discord servers, and various public sources. They should contain advanced technical information or cutting edge tools and implementations. No low-effort, AI-generated or "write your first loader" tutorials are included. Obviously wrong or obsolete information are also not included.
Purposes:
- Enable LLMs to query for up to date information (NotebookLM)
- Make current offset knowledge searchable (RAG)
- Find offsec tools / implementations (grep)
- Aquire knowledge (read)
- Re/Train LLMs with relevant information
So i provide:
- Lists of links categorized by topic (.txt)
- The content of the page as markdown and HTML (.md, .html)
- The metadata of the page (.json)
- A AI summary of the page (.llm)
Not included:
- Linkedin posts (no thanks)
- Twitter posts (because of the owner)
- Medium posts which require authentication (non-public information)
- PDFs (think of all the tokens!)
- Youtube
OpenNotebook is not really usable for this currently but maybe soon (February 2026).
- Download one of the topic zip's (contains the markdown of the links)
- "Notebooks" -> "New Notebook" - give it a name like "MalDev_notebook"
- Open "MalDev_notebook" -> "Add Source"
- "Upload File" -> select the .zip
- next -> "Notebooks": select the "MalDev_notebook"
- next -> "Transformations": select everything except "Reflection Questions", especially "Key Insights", and keep checked "Enable embedding for search"
- Wait for it to be indexed
Usecase A:
- Open "MalDev_notebook"
- Ask a question
- NOTE: By default, it will push all the LLM generated "Insights" ONLY into the prompt
Usecase B:
- click the lightbulb icon ("insights only" -> "full content") of each source
- Ask a question
- NOTE: This will push the full text into the context - requires large context size, e.g. Gemini, but wont work with many sources
Usecase C:
- click "Ask and search" -> Search
- This will search the content, either text, or vector search
- NOTE: Current version searches through all sources, not per-notebook
Usecase D:
- click "Ask and search" -> "Ask (beta)"
- Ask your question
- NOTE: This uses all your sources, not per-notebook
How to use with Onyx App (February 2026)
- Download one of the topic zip's (contains the markdown of the links)
- "Add Connector" -> "File" -> Upload the ZIP - wait for it to be indexed. Give it a name like "MalDev_Connector".
- "Document Sets" -> "New Document Set" - add the connector above "MalDev_Connector", give it a name like "MalDev_Set"
- "Assistants" -> "Create Assistant" -> "Enable Knowledge" - add "MalDev_Set", give it a name like "MalDev_Assist"
- "Agents" -> "MalDev_Assist", click the weird settings icon, click "Internal Search" - there should be a blue "Internal Search" under the Chat
How to use with Googles NotebookLM (February 2026)
- "Create new Notebook"
- "Upload Files" -> select all
.mdfiles manually (no .zip supported)
Note: It cannot handle more than 50 source files lol.
Define the keys in command line, or in .env:
FIRECRAWL_API_KEY=fc-...
OPENAI_API_KEY=sk-...
app/scrape_urls.py gonna download links in data/in/ using Firecrawl:
PS C:\Users\dobin\Repos\AwesomeMalDevLinks> python.exe .\app\scrape_urls.py
Found 11 input files
Processing topic: aioffense
Found 16 URLs
[1/16] Processing: https://github.com/nuryslyrt/ORPHEUS
Saved to: data\out\aioffense\github.com_nuryslyrt_orpheus.md
Saved to: data\out\aioffense\github.com_nuryslyrt_orpheus.html
Saved to: data\out\aioffense\github.com_nuryslyrt_orpheus.json
...
Then, use app/llm_summary.py to generate the .llm:
PS C:\Users\dobin\Repos\AwesomeMalDevLinks> python.exe .\app\llm_summary.py
Found 1075 .md files total.
[1/1075] aioffense\battlebench.ai.md
Content length: 4657 chars
Saved: battlebench.ai.llm
...