How dc401/nostarch-evasion-engineering works
This repository is a book-lab collection of independent red-team and defensive tools, not one integrated application. Its broad user journey is learning design and evasion techniques, building operational tooling, then analyzing or validating detections; each chapter’s programs are generally invoked separately. The README documents a Chapter 3 cloud-scanning workflow, but no Chapter 3 source appears in the supplied tree, so it is noted here rather than represented with an unsupported path. Some links reflect README-described workflows because the corresponding source was not sampled.
Main entry points: goslowc2-firestore-1.2.go Firestore C2 Agent · encode.go Hybrid Packing · gologexfil-1.1.go Log Exfiltration · gologretrieve-1.1.go Log Retrieval
Components 21
Design And Evasion
- Design Examples
chapter-01 - Evasion Example
chapter-02/hex2cipher.py
Operational Tools
- Firestore C2 Agent
chapter-04/goslowc2-firestore-1.2/goslowc2-firestore-1.2.go - Firestore
- SSH Worm
chapter-05/main.go - Host Enumeration
chapter-06/hostnmae.go - User And Groups
chapter-06/ug.go - Process Enumeration
chapter-06/proc.go - Network Enumeration
chapter-06/nt.go - Hybrid Packing
chapter-07/encode.go - Shellcode Loader
chapter-07/loader.go
Staging And Exfiltration
- CAB Staging
chapter-08/gostagecab/gostagecab.go - Log Exfiltration
chapter-08/gologexfil/gologexfil-1.1.go - Cloud Logging
- Log Retrieval
chapter-08/gologexfil/gologretrieve-1.1.go
Detection Tools
- Go Binary Analyzer
chapter-09/go-analyzer/go-analyzer.go - Network Detector
chapter-09/network-detector/network-ttp-detector-1.1.py - PAN Log Generator
chapter-09/network-detector/pan-log-generator-1.1.py
Detection Validation
- IAM Simulation
chapter-10/lambda-iam-sim.py - CloudTrail And CloudWatch
Other components
- Security Practitioner
Connections 23
- Security Practitioner → Design Examples: runs examples
- Security Practitioner → Evasion Example: runs example
- Security Practitioner → Firestore C2 Agent: deploys agent
- Firestore C2 Agent → Firestore: reads and updates
- Security Practitioner → SSH Worm: runs worm
- Security Practitioner → Host Enumeration: runs tool
- Security Practitioner → User And Groups: runs tool
- Security Practitioner → Process Enumeration: runs tool
- Security Practitioner → Network Enumeration: runs tool
- Security Practitioner → Hybrid Packing: builds payload
- Hybrid Packing → Shellcode Loader: prepares payload for
- Security Practitioner → Shellcode Loader: runs loader
- Security Practitioner → CAB Staging: stages files
- Security Practitioner → Log Exfiltration: runs exfiltration
- Log Exfiltration → Cloud Logging: writes entries
- Security Practitioner → Log Retrieval: retrieves data
- Log Retrieval → Cloud Logging: reads entries
- Security Practitioner → Go Binary Analyzer: analyzes binary
- Security Practitioner → PAN Log Generator: generates logs
- PAN Log Generator → Network Detector: supplies sample logs
- Security Practitioner → Network Detector: analyzes traffic
- Security Practitioner → IAM Simulation: runs simulation
- IAM Simulation → CloudTrail And CloudWatch: validates telemetry