41554 blogs · 4,417,066 posts Claim your blog

Record · corpus.blog/posts/01a08778-e061-7066-a991-c1021f29bee1

DLL Injection EDR Evasion 1: Hiding an elephant in the closet

fluxsec.red · published 2 February 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at fluxsec.red Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 14
Words captured: 2,250

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://fluxsec.red/

fluxsec.red

Reading Event Tracing for Windows Threat Intelligence Read at the source ↗

https://www.ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis

ired.team

https://github.com/winsiderss/phnt/blob/7c1adb8a7391939dfd684f27a37e31f18d303944/ntmmapi.h

github.com

https://codemachine.com/articles/system_call_instructions.html

codemachine.com

https://github.com/cr-0w

github.com

Hells Gate Rust - EDR Evasion with syscalls Read at the source ↗

EDR Evasion ETW patching in Rust Read at the source ↗

Remote process DLL injection in Rust Read at the source ↗

https://github.com/0xflux/GoSneak

github.com

https://www.ired.team/offensive-security/defense-evasion/detecting-hooked-syscall-functions

ired.team

https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/

alice.climent-pommeret.red

https://github.com/winsiderss/phnt

github.com

https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls

redops.at