01
Built for detection engineers
Violethat is designed specifically for practitioners focused on endpoint detection engineering — not generic cybersecurity training.
First-of-its-kind for blue teams
Where Blue Teams finally get to play with hooks.
A hands-on playground for detection engineers, blue teamers, and security researchers — write C/C++, run the agent, and watch every hook fire in real time.
>ENGINEERED.TO.BUILD.DETECTIONS
- DPIIT Recognized
- Browser-native IDE
- Built by practitioners
- Certified ISO 9001:2015
>why.violethat
Why Vio_ethat?
Built by practitioners, Four reasons defenders should choose VioletHat.
- 02
Research, Learn, Detect
Explore real-world threats, understand how they operate, and turn your findings into practical detection strategies.
- 03
Realistic, threat-focused learning
Every challenge and dataset is created to reflect real-world attacker behavior, helping defenders think and act practically.
- 04
Career-relevant, hands-on experience
Users gain practical exposure and applied skills that directly translate to modern detection and blue-team roles.
>ide.live.demo
Capture flags through API-level visibility.
No setup. No VM. No install. Write C/C++ in the browser, run the agent, watch the logs.
violethat — challenge-042 / hook-detectionAgent Live
hook.c
// challenge-042 — hook CreateFileW
#include <windows.h>
#include "MinHook.h"
typedef HANDLE(WINAPI* CreateFileW_t)(LPCWSTR, ...);
CreateFileW_t OrigCreateFileW = nullptr;
HANDLE WINAPI HookedCreateFileW(LPCWSTR path, ...) {
Logger::Log("intercepted: %ls", path);
return OrigCreateFileW(path, ...);
}Agent Outputrunning
$ ./agent --run
[+] hooking CreateFileW... ok
[+] hook successful
[+] flag candidate found
[+] verifying with server...
Flag capturedVHCTF{hook_w1n_2024}
>platform.pillars
Built for real detection engineering.
Three pieces that turn a browser tab into a working endpoint detection lab.
01 · adversary.simulation Real adversary techniques. Real detection logic.
Practice against the same TTPs your team sees in production — initial access, process injection, evasion chains. Build detections that hold up in the real world.
Explore challenges02 · zero.setup In-browser IDE. Zero setup.
Monaco editor, C/C++ tooling, syntax highlighting, multi-file support. Open a challenge and start writing — no VMs, no Docker, no VPN gymnastics.
Open the IDE03 · live.telemetry Live agent runner. Real-time logs.
Compile, hit Run, watch your code execute against the target. Every hook and syscall streamed back to you in seconds.
See the agent
>pricing.tiers
Simple pricing. No surprises.
Start free. Upgrade when you are ready. Cancel anytime.
- tier.free
Free
Get hands-on with the platform — no card required.
Free- Access to 10+ starter challenges
- In-browser IDE (C/C++)
- Live agent runner with streaming logs
- Community leaderboard
- Personal progression dashboard
- Most Popular
No monthly plans yet
Unlock premium content through individual challenge purchases. Monthly and yearly plans are coming soon.
>ready.to.run
Capture your first flag today.
No setup. No VM. No install. Sign up free and start building your first detection.
No card required · 20+ free challenges · Cancel anytime