VioletHat logoVio£ethat
Login
VioletHat logoVio£ethat

Cybersecurity coding challenges — EDR, hooking, and detection engineering labs

Browse hands-on cybersecurity coding challenges covering API hooking, EDR detection, malware analysis, syscall instrumentation, and adversary simulation. Write C and C++ in the browser, run a sandboxed agent against the target, and capture flags in real time.

What are Violethat challenges?

Each challenge is a hands-on coding lab that targets a real detection-engineering or adversary-simulation skill. You write C or C++ in the browser-native IDE, a sandboxed agent compiles and runs your code against the target, and live agent telemetry streams stdout, stderr, hook traces, and verification results back to you over a WebSocket. When your implementation succeeds, the flag is surfaced automatically — no manual submission required.

Topics covered

  • API hooking and inline detours
  • Syscall instrumentation and tracing
  • EDR detection and bypass research
  • Malware analysis and reverse engineering
  • Adversary simulation and red-team tradecraft
  • AI security and adversarial ML
  • Process injection and memory forensics

Who is this for?

Detection engineers, blue team analysts, malware researchers, security engineers, and operators who want to practice the techniques real attackers use — and write the detections that catch them — in a sandboxed environment built for the work, not the demo.

All challenges (4)

  • A Simple Reverse Shelleasy — Topics: T1204.002 - User Execution: Malicious File

    During an internal investigation, a security team observes an application establishing an outbound connection and shortly afterward launching a command shell. T

  • Borrowed Lineagemedium — Topics: T1134.004 - Parent PID Spoofing

    A threat actor has successfully executed malware on a compromised workstation but faces one remaining challenge-avoiding detection by endpoint security solution

  • Back After Booteasy — Topics: T1547.001 - Registry Run Keys / Startup Folder

    A detection engineer is analyzing activity from an endpoint where a suspicious program briefly modified the Windows Registry during execution. The change appear

  • Inside the Targethard — Topics: T1055.002 - Process Injection: Portable Executable Injection

    A workstation alert indicates suspicious behavior originating from a trusted application. Initial investigation shows no anomalies in the application's parent p

>challenges.index

Develop hooks. Compile. Detect.

Practice Endpoint Detection Engineering through coding challenges because malware shouldn’t be the only one using hooks.

0
Challenges
0
Topics
0
Submissions
>filter.topics
0 results
~
no_results

No challenges match your query

Try adjusting your filters or search criteria