Cybersecurity coding challenges — EDR, hooking, and detection engineering labs
Browse hands-on cybersecurity coding challenges covering API hooking, EDR detection, malware analysis, syscall instrumentation, and adversary simulation. Write C and C++ in the browser, run a sandboxed agent against the target, and capture flags in real time.
What are Violethat challenges?
Each challenge is a hands-on coding lab that targets a real detection-engineering or adversary-simulation skill. You write C or C++ in the browser-native IDE, a sandboxed agent compiles and runs your code against the target, and live agent telemetry streams stdout, stderr, hook traces, and verification results back to you over a WebSocket. When your implementation succeeds, the flag is surfaced automatically — no manual submission required.
Topics covered
- API hooking and inline detours
- Syscall instrumentation and tracing
- EDR detection and bypass research
- Malware analysis and reverse engineering
- Adversary simulation and red-team tradecraft
- AI security and adversarial ML
- Process injection and memory forensics
Who is this for?
Detection engineers, blue team analysts, malware researchers, security engineers, and operators who want to practice the techniques real attackers use — and write the detections that catch them — in a sandboxed environment built for the work, not the demo.
All challenges (4)
- A Simple Reverse Shell — easy — Topics: T1204.002 - User Execution: Malicious File
During an internal investigation, a security team observes an application establishing an outbound connection and shortly afterward launching a command shell. T
- Borrowed Lineage — medium — Topics: T1134.004 - Parent PID Spoofing
A threat actor has successfully executed malware on a compromised workstation but faces one remaining challenge-avoiding detection by endpoint security solution
- Back After Boot — easy — Topics: T1547.001 - Registry Run Keys / Startup Folder
A detection engineer is analyzing activity from an endpoint where a suspicious program briefly modified the Windows Registry during execution. The change appear
- Inside the Target — hard — Topics: T1055.002 - Process Injection: Portable Executable Injection
A workstation alert indicates suspicious behavior originating from a trusted application. Initial investigation shows no anomalies in the application's parent p
Develop hooks. Compile. Detect.
Practice Endpoint Detection Engineering through coding challenges because malware shouldn’t be the only one using hooks.
No challenges match your query
Try adjusting your filters or search criteria