🔀 Direct Syscalls vs Indirect Syscalls

This post discusses Indirect Syscalls as a solution to eliminate indicators of compromise and avoid detection by EDRs. Indirect Syscalls allow the execution of Syscall and Return statements in the memory of ntdll.dll, which is the usual behavior in Windows.

https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls

#maldev #syscall #edr #bypass