Record · corpus.blog/posts/01a08778-e062-7361-8645-b4b15c6275ab

Detecting Vectored Exception Handling Squared in an EDR

fluxsec.red · published 11 January 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at fluxsec.red Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 27
Words captured: 3,806

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/0xflux/Sanctum

github.com

https://github.com/0xflux/Sanctum/blob/main/driver/src/core/veh_monitor.rs

github.com

Vectored Exception Handling Squared Read at the source ↗

fluxsec.red

https://www.crowdstrike.com/en-us/blog/crowdstrike-investigates-threat-of-patchless-amsi-bypass-attacks/

crowdstrike.com

https://github.com/0xflux/Wyrm

github.com

A journey through KiUserExceptionDispatcher Read at the source ↗

momo5502.com

https://web.archive.org/web/20031011125738/http://www.microsoft.com/msj/0197/exception/exception.aspx

web.archive.org

https://www.vergiliusproject.com/kernels/x64/windows-11/25h2/_KTRAP_FRAME

vergiliusproject.com

https://www.vergiliusproject.com/kernels/x64/windows-11/25h2/_KTHREAD

vergiliusproject.com

https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-context

learn.microsoft.com

https://github.com/mirror/processhacker/blob/master/1.x/branches/ph-plugins/KProcessHacker/include/ps.h

github.com

https://www.unknowncheats.me/forum/c-and-c-/210736-psgetcontextthread-returns-status_unsuccessful.html

unknowncheats.me

https://github.com/0xflux/Sanctum/blob/55334d8b91bbb88a3e1ef8d74014699ffdbfbf07/driver/src/utils.rs

github.com

https://doc.rust-lang.org/core/mem/fn.transmute.html

doc.rust-lang.org

https://www.vergiliusproject.com/kernels/x64/windows-11/25h2/_ETHREAD

vergiliusproject.com

https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-memory_basic_information

learn.microsoft.com

https://gist.github.com/wbenny/0d2269a8ae93c420d013632dc2cd432f

gist.github.com

https://www.codeproject.com/articles/Internals-of-Windows-Thread

codeproject.com

https://stackoverflow.com/questions/41734911/where-is-a-usermode-thread-context-stored-and-is-it-possible-to-modify

stackoverflow.com

https://www.unknowncheats.me/forum/anti-cheat-bypass/687803-pspgetcontextthreadinternal-createthreadnotifyroutine.html

unknowncheats.me

https://www.nccgroup.com/research-blog/detecting-anomalous-vectored-exception-handlers-on-windows/

nccgroup.com

https://rayanfam.com/topics/hypervisor-from-scratch-part-8/

rayanfam.com

https://research.meekolab.com/the-basics-of-intel-vt-x-extensions

research.meekolab.com

https://cymulate.com/blog/blindside-a-new-technique-for-edr-evasion-with-hardware-breakpoints/

cymulate.com

https://www.ibm.com/think/x-force/using-veh-for-defense-evasion-process-injection

ibm.com

https://cdrdv2-public.intel.com/825750/326019-sdm-vol-3c.pdf

cdrdv2-public.intel.com

https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/architecture

learn.microsoft.com