Potential operation evasion via direct syscall

Identifies processes invoking system operations via direct syscalls. Adversaries and offensive tooling use this technique to evade user-mode API hooks placed by EDR/AV products, since hooks typically instrument the ntdll.dll wrapper functions rather than the kernel syscall dispatch itself.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055

Volver a todas las reglas