The Engagement
During a recent adversary simulation for a critical infrastructure client, our Red Team was tasked with bypassing a heavily tuned, market-leading Endpoint Detection and Response (EDR) solution. The objective was to execute arbitrary code in memory without triggering behavioral alerts.
The Technique: Indirect Syscalls & Unhooking
Modern EDRs rely heavily on user-land API hooking (placing jumps inside functions like NtAllocateVirtualMemory) to monitor execution. To evade this, our team developed a custom loader that dynamically resolved the system call numbers at runtime and executed the syscall instructions directly, bypassing the hooks entirely.
Memory Allocation Strategy
Instead of using standard memory allocation flags (like PAGE_EXECUTE_READWRITE, which is highly suspicious), we allocated memory as PAGE_READWRITE, copied our obfuscated shellcode, and then used a secondary rop-chain technique to flip the memory protection to PAGE_EXECUTE_READ right before execution.
The Takeaway
The attack was completely undetected by the EDR. This exercise proved to the client that relying solely on automated tooling is insufficient. Defense-in-depth, including proactive threat hunting and continuous Red Team engagements, is critical to securing modern infrastructure.