Open-source tooling built for and during PurpleRanges scenarios. The maldev library, loaders, BOFs, UDRLs, and detection rules used across the kill chains published on this site. Per-tool documentation pages land soon.
Malware Developer Kit. The primitives behind the loaders.
A library of small pieces for building Windows loaders with less code. Includes process and thread control, memory read / write, indirect syscalls, hardware-breakpoint hooking, HWBP-based AMSI and ETW bypass, module stomping, PPID spoofing, IAT camouflage, process and thread discovery, and injection primitives (classic, section-map, APC, thread hijack).
Example Windows loaders built against MDK.
Self-contained Windows loader PEs. Each picks a different mix of MDK primitives.
Beacon Object Files.
A collection of Beacon Object Files for Active Directory and credential-access operations on Windows.
User-Defined Reflective Loader for Adaptix.
Reflective loader for Adaptix beacons built on Crystal Palace.
Sigma rules and ATT&CK Navigator layers.
Every detection rule shipped alongside a PurpleRanges scenario, in Sigma 2.0 format, organized by ATT&CK tactic. Includes the per-scenario Navigator layers with PTEF coverage scores and the blind spots we validated during execution.
No scenarios published yet
Scenario-observed tools will show up here once scenarios ship.