3 min read
TOC
Arcana – Curated List of Useful Offensive Tradecraft Resources
Low-Level Languages
Low-Level Concepts
Build core knowledge around system internals, cryptography, and debugging.
- Obfuscation, encryption, decryption, and common algorithms
- Learn to use debuggers (e.g., x64dbg)
Windows Internals
- Introduction to Malware Development
- cr0w – Processes, Threads & Handles
- Download Windows Internals, Part 1 and use it as a reference whenever you want to dive deeper into a topic you’re currently learning.
Project Ideas
Try to replicate a malware behavior and ask:
- What is being performed?
- How is it being performed?
- Are there alternative techniques?
- Can we replicate the API usage?
Content Creators
Blogs
GitHub Repositories
Books & Papers
References
Operational Security
- Red Team Operational Security Explained
- Black Hills – Operational Security Fundamentals
- When Cybercriminals with Good OPSEC Attack
Detection Awareness
- The DFIR Report – Learn from adversaries’ OPSEC failures.
- EDR Telemetry
- Sigma Rules – Learn how blue teams build detection logic.
- Sysmon Configuration – Familiarize yourself with common logging configurations. If a TTP is covered by Atomic Red Team, consider it a strong hint that defenders may have detection coverage for it.
- Sigma Rules – Windows
- Cobalt Strike OPSEC Considerations
Useful Pages
Training
Books
Practical EDR Evasion
Deploy the client’s EDR in a lab and test your payload against it. When something gets detected, identify the behavior or artifact that triggered the alert, research the detection mechanism, then modify your tradecraft to address it.
The workflow is essentially:
Deploy EDR → Run payload → Observe detection → Identify the cause → Research → Address the detection surface → Retest
Don’t blindly apply evasion techniques. Understand what is being detected and why, then solve that specific detection problem. Keep useful telemetry such as Sysmon, ETW, Windows Event Logs, memory and call-stack visibility, and network telemetry available so you can correlate EDR alerts with what actually happened.
For example, if a loader is detected, determine whether the signal came from the executable itself, process behavior, memory characteristics, call stacks, or network activity. Address the relevant detection surface rather than changing unrelated parts of the payload.
The same principle applies to techniques such as Kerberoasting: understand the underlying telemetry and expected baseline first, then determine what behavior distinguishes your activity from normal operations.
Resources from Colleagues
Archives
Reverse Engineering & Pwn Resources
Foundational Learning
- Dayzerosec – Getting Started
- Secnate – Exploit Development
- OpenSecurityTraining2 – x86-64 Assembly
- Z0F Reverse Engineering Course
- Nightmare
- pwn.college
Applied Reverse Engineering
Advanced & Kernel Exploitation
Hands-On Practice
Challenge-based platforms and exercises to reinforce your skills.
Blogs
Contributors
Thanks to the following people:
- @Lattice23 – Helped with resources and structure.