Al-Khaser
Public malware techniques used in the wild: Virtual Machine, Emulation
al-khaser is an open-source proof-of-concept security tool that deliberately implements techniques commonly used by real-world malware to test and evaluate the effectiveness of antivirus and endpoint detection and response (EDR) systems. It’s written in C/C++ and designed to execute a wide range of anti-analysis, anti-debugging, anti-virtualization, timing-based evasion, and sandbox detection routines so security researchers and defenders can see how well their tools detect or ignore these behaviors. The project includes checks for debugger presence, stealthy anti-dumping measures, various VM and sandbox artifacts, and process injection techniques, giving you a broad view of how defensive tools respond under stress. al-khaser isn’t malicious by intent — its purpose is to help security teams identify gaps in their detection logic and harden defenses by simulating evasive behaviors without actual payloads.