Potential operation evasion via direct syscall

Identifies processes invoking system operations via direct syscalls. Adversaries and offensive tooling use this technique to evade user-mode API hooks placed by EDR/AV products, since hooks typically instrument the ntdll.dll wrapper functions rather than the kernel syscall dispatch itself.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055

Back to all rules