Evasion Engineering Building Custom Red Team Tools for Modern Defenses (Dennis Chow) (z-library.sk, 1lib.sk, z-lib.sk)

【One-Line Pitch】 A hands-on guide for aspiring red teamers who want to stop burning commodity frameworks and start building their own Go-based offensive tools—while learning, chapter by chapter, exactly how defenders would catch them. 【Book Arc】 - **Opening (~0%–10%)**: Frames the core premise—public tooling is already fingerprinted, so operators must build custom payloads with detection in mind—and introduces the authors' offensive-plus-defensive credentials and the book's three-part structure. - **Early (~10%–35%)**: Part I lays the engineering groundwork: the "Three Rs" of tool design (robustness, reusability, reliability), requirements gathering, logging, redirection infrastructure, and a survey of evasion strategies (timing, low-entropy encryption, naming conventions, code signing, language/architecture switching). - **Middle (~35%–55%)**: Part II opens the hands-on labs—building a serverless web scanner with AWS Lambda/CloudFormation/Step Functions, then a command-and-control implant on GCP in Go, moving from design requirements to deployed tooling. - **Late (~55%–64%)**: The labs get more evasive: replacing LOLBins with custom Go enumerators (LDAP, gopsutil), hybrid packing that converts executables to shellcode and hides payloads as IPv4-like text, and a covert CAB-based exfiltration pipeline disguised as cloud logging entries. - **Ending (~64%–100%)**: Part III flips to defense—a Go binary analyzer and Python beaconing detector, then "controlled reveals" that simulate Lambda IAM abuse and EC2 ransomware TTPs against CloudTrail/CloudWatch, closing with an appendix on environment setup. 【Key Takeaways】 - **Public tools are pre-burned; custom tooling is the differentiator** (Opening): the book's thesis is that defenders have catalogued Cobalt Strike and Metasploit signatures, so operators must design around behavioral detection rather than indicator obfuscation. - **Treat offensive tools like maintained software, not throwaway scripts** (Early): the "Three Rs"—robustness, reusability, reliability—plus naming standards, logging, and exception handling make payloads survive real engagements. - **Evasion is a design discipline, not a post-hoc trick** (Early): timing operations, blending with end-user behavior, low-entropy encryption, and false flags are planned into the tool from requirements onward. - **Cloud infrastructure is part of the toolkit** (Middle): AWS Lambda, VPC, CloudFormation, and Step Functions are used to build persistent, redirectable scanning infrastructure—showing red teaming increasingly lives in cloud services. - **Go is the implementation language of choice** (Middle): C2 implants, enumerators, and analyzers are all built in Go, leveraging its static binaries and runtime introspection. - **Avoiding LOLBins reduces behavioral signature** (Late): five custom Go tools replace shell-based OS/user/network/process enumeration, sidestepping the shell-execution patterns defenders watch for. - **Packing and exfiltration can hide in plain sight** (Late): Donut-based shellcode conversion, IPv4-disguised payloads, and CAB-staged, hex-encoded cloud-logging exfiltration target file-based and DLP detection. - **Every offensive chapter has a defensive mirror** (Ending): binary analysis, statistical beaconing detection, and CloudTrail/CloudWatch simulations turn the book into a two-way detection-engineering exercise. 【Reading Tips】 - **Deep-read Part I even if eager to code**: the requirements/design framing (epics, user stories, ROI matrix) is what separates reusable tooling from one-off scripts and pays off in every later lab. - **Skim the cloud setup boilerplate** (Lambda/VPC/CloudFormation/GCP setup) unless you're actively deploying; the conceptual architecture matters more than the console clicks on a first pass. - **Pair each offensive lab with its Part III counterpart**: read Chapter 7 (packing) alongside Chapter 9 (binary analysis) to internalize the build-then-detect loop. - **Have the GitHub repo open**: the book references complete lab code at dc401/nostarch-evasion-engineering; typing along is more valuable than reading listings. - **Check the appendix first if Go or cloud is new**: the authors explicitly assume prior web/cloud/Linux/networking fluency and point newcomers there. 【Coverage Limits】 The excerpts are heavily weighted toward front matter, the table of contents, and Part I design chapters; detailed technical content from the Part II labs and Part III detection chapters is only summarized at the chapter-description level, so specific code mechanics are not covered here.