Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation

Malware Analysis
1

In case images fail to load, it might be due to jsDelivr CDN ban in Egypt. To resolve this, consider using a VPN. :slight_smile:
Syscalls? Why? To Bypass user-mood hooks. why? For Hiding a code inside a legitimate process (Process Injection) Avoiding EDR alerts! User-mood Hooks Hooking user-mode functions by placing a jump to another code section. EDRs use hooks to check the function parameters. For example, if you are trying to change the memory protections of some data to add executable protections.

Article Link: Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation - d01a