Potential NTDLL unhooking via file mapping

Identifies processes that map a fresh image view of NTDLL.dll from disk, a behavior commonly associated with user-mode API unhooking. Malware often remaps the original NTDLL image to restore pristine code sections and bypass user-mode security hooks placed by EDRs or AMSI.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055

Volver a todas las reglas