LayerFault/evasion-archive-inside-archive
Updated • 11
LF Security Corpus: Package Evasion & Correlation
Filename, nesting, dilution, indirection and cross-file correlation challenges. Synthetic security fixtures, not usable models.
Note LF-CH-EVAS-0005: Nested ZIP contains a marker several layers down.
LayerFault/evasion-base64-split-marker
Updated • 11Note LF-CH-EVAS-0006: Marker is split and base64 encoded across several files.
LayerFault/evasion-benign-noise-dilution
Updated • 8Note LF-CH-EVAS-0011: One marker is buried among many benign decoy files.
LayerFault/evasion-case-variant-sidecar
Updated • 11Note LF-CH-EVAS-0003: Dormant sidecar uses mixed case in path and extension.
LayerFault/evasion-cross-format-chain
Updated • 12Note LF-CH-EVAS-0016: Config references an image that appends an archive containing dormant source.
LayerFault/evasion-decoy-plus-hidden-sidecar
Updated • 11Note LF-CH-EVAS-0015: A normal preview is paired with a hidden sidecar marker.
LayerFault/evasion-deep-path-nesting
Updated • 10Note LF-CH-EVAS-0004: Marker is hidden under a deeply nested package path.
LayerFault/evasion-double-extension-sidecar
Updated • 10Note LF-CH-EVAS-0002: Dormant Python sidecar hides behind a double extension.
LayerFault/evasion-hex-split-marker
Updated • 9Note LF-CH-EVAS-0007: Marker is split as hexadecimal text across files.
LayerFault/evasion-js-string-concat-capability
Updated • 8Note LF-CH-EVAS-0009: Dormant JavaScript child-process strings are reconstructed at runtime.
LayerFault/evasion-manifest-reference-indirection
Updated • 10Note LF-CH-EVAS-0013: Several manifests must be followed to reach the marker.
LayerFault/evasion-many-files-one-indicator
Updated • 9Note LF-CH-EVAS-0012: A single indicator appears among hundreds of benign files.
LayerFault/evasion-multi-file-fragmented-capability
Updated • 10Note LF-CH-EVAS-0010: Capability name and function fragments are distributed across files.
LayerFault/evasion-path-normalization-collision
Updated • 10Note LF-CH-EVAS-0014: Two paths normalize to visually equivalent names with different content.
LayerFault/evasion-python-string-concat-capability
Updated • 11Note LF-CH-EVAS-0008: Dormant Python capability strings are reconstructed at runtime.
LayerFault/evasion-unicode-filename-confusable
Updated • 11Note LF-CH-EVAS-0001: Package sidecar uses a Unicode-confusable filename.