> For the complete documentation index, see [llms.txt](https://sec565.gitbook.io/vibecoding-a-defense-evasion-framework/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sec565.gitbook.io/vibecoding-a-defense-evasion-framework/readme.md).

# README

Build a shellcode loader generator with configurable evasion techniques using AI-assisted development.

In this workshop, we take a guided approach to building custom security tooling with AI. Rather than asking an LLM for "the whole application" and getting hallucinated garbage, we follow a **"think then act" methodology** — using AI to create a Product Requirements Document first, then implementing features phase-by-phase with verification at each step.

Before we build anything, we cover *why* custom tooling matters (off-the-shelf tools get signatured), *how* detection works (static analysis, dynamic analysis, AMSI), and *why* each evasion technique in our framework counters a specific detection mechanism. You'll leave understanding the fundamentals, not just the tool.

By the end, you'll have a working Dockerized web application that generates custom C# payloads with options including payload bloating, sleep delays, anti-sandbox checks, environmental keying, and entropy reduction — all created through AI-assisted "vibe coding."

{% hint style="warning" %}
**LLMs are probabilistic.** They may produce different outputs each time you run the same prompt. Your code may differ from the examples shown here — that's expected. What matters is that it works and you understand what it does. Always verify AI-generated code against official documentation.
{% endhint %}

## Workshop Structure

| Section                                  | Duration | Type       |
| ---------------------------------------- | -------: | ---------- |
| Introduction & Vibe Coding Philosophy    |   10 min | Lecture    |
| Effective Prompting for Code Gen         |   10 min | Lecture    |
| Understanding Defense Evasion            |   15 min | Lecture    |
| What We're Building & Evasion Techniques |   15 min | Lecture    |
| Architecture & PRD Walkthrough           |   10 min | Lecture    |
| Exercise 1: Create the PRD               |   15 min | Hands-on   |
| Exercise 2: Docker & Streamlit UI        |   15 min | Hands-on   |
| Exercise 3: C# Code Gen & Evasion        |   20 min | Hands-on   |
| Exercise 4: Test the Framework           |   15 min | Hands-on   |
| Wrap-up & Q\&A                           |   10 min | Discussion |

## TTPs Covered

| Technique                                       | MITRE ID                                                    |
| ----------------------------------------------- | ----------------------------------------------------------- |
| Obfuscated Files or Information                 | [T1027](https://attack.mitre.org/techniques/T1027/)         |
| Virtualization/Sandbox Evasion: System Checks   | [T1497.001](https://attack.mitre.org/techniques/T1497/001/) |
| Execution Guardrails: Environmental Keying      | [T1480.001](https://attack.mitre.org/techniques/T1480.001/) |
| Process Injection                               | [T1055](https://attack.mitre.org/techniques/T1055/)         |
| Software Discovery: Security Software Discovery | [T1518.001](https://attack.mitre.org/techniques/T1518.001/) |