---
id: 6078
title: "Malware development part 5 - tips & tricks"
source_domain: 0xpat.github.io
source_url: "https://0xpat.github.io/Malware_development_part_5/"
published_at: "2020-11-04T00:00:00Z"
tags: ["red-team", "malware-development", "environmental-keying", "parent-pid-spoofing", "edr-evasion", "process-protection"]
phying_url: "https://phying.com/item/6078"
lang: en
---

# Malware development part 5 - tips & tricks

## Summary

Malware dev part 5: parent PID spoofing via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, process-hardening against EDR (ACG, Microsoft-only binaries), environmental keying and config brute-forcing.

## Intelligence Metadata

- **Sources:** 0xpat.github.io
- **Published:** 2020-11-04T00:00:00Z
- **Original:** https://0xpat.github.io/Malware_development_part_5/
- **Phying News:** https://phying.com/item/6078