Listen to this Post
Introduction:
In the high-stakes arena of modern cybersecurity, the arms race between offensive red teams and defensive security solutions has never been more intense. At the core of this battle lies Endpoint Detection and Response (EDR) systems, which operate by “hooking” or injecting code into critical system processes to monitor for malicious activity. A sophisticated technique to counter this is “EDR Unhooking,” a process that neutralizes these hooks, effectively blinding the EDR to an operator’s actions from within the kernel.
Learning Objectives:
- Understand what EDR unhooking is and why it is necessary for advanced red team operations.
- Learn the step-by-step process of manual DLL mapping to load a clean copy of
ntdll.dll. - Identify the pitfalls and limitations of unhooking, such as monitoring of file reads and the persistence of ETW telemetry.
- Explore a curated list of online courses and certifications for advancing red team and purple team skills.
You Should Know
- Manual DLL Mapping: The “Clean Copy” Approach to Unhooking
The core concept of this evasion technique is disarmingly simple: instead of trying to patch or bypass the hooks placed in the current, compromised copy of ntdll.dll, why not just load a fresh, untouched copy directly from the disk? The file on the disk (C:\Windows\System32\ntdll.dll) is not hooked, as EDRs inject their hooks into the DLL after it has been loaded into a process‘s memory. This technique, known as manual DLL mapping, allows you to bypass user-mode hooks entirely. Below is a step-by-step guide for implementing this on a Windows system.
Step-by-Step Guide: Manual DLL Mapping of ntdll.dll
- Locate the Clean Source: The first challenge is accessing a clean copy of the DLL. Reading `ntdll.dll` directly from disk can be monitored. A stealthier method is to access it from the `\KnownDlls` section using native API calls like `NtOpenSection` and
NtMapViewOfSection. - Allocate Memory: Use `VirtualAlloc` to allocate a new block of memory within your process. This will serve as the home for the clean DLL.
- Parse and Copy Sections: Manually parse the Portable Executable (PE) structure of the clean DLL and copy its sections (like
.text,.data,.rdata) into the newly allocated memory. This is a complex process that requires handling the file’s headers. - Fix Relocations: DLLs are not guaranteed to be loaded at their preferred base address. You must parse the relocation table and adjust the absolute addresses within the copied code to point to the new memory location.
- Resolve Imports: The new `ntdll` will likely depend on `kernel32.dll` or other system libraries. You must resolve these imports by finding the addresses of the required functions from the hooked version in memory and then patching the Import Address Table (IAT) of your clean copy.
- Call Clean Functions: Once the clean DLL is mapped, you can directly call its exported functions (e.g.,
NtCreateFile). Because you are calling a version of the code that has never been touched by the EDR, user-mode hooks are completely avoided. - Sample Code: Joas A. Santos provides a practical example in his repository. To explore the source code for this technique, you can visit his GitHub page, which serves as a comprehensive resource for all his Red Team Exercises.
Linux / Windows Commands & Code Snippets
Below is a simplified conceptual code snippet to demonstrate the Windows API calls required to map a section from the `\KnownDlls` directory:
// Stealthier method to get a handle to ntdll.dll from \KnownDlls
HANDLE hSection;
UNICODE_STRING objName;
RtlInitUnicodeString(&objName, L"\KnownDlls\ntdll.dll");
OBJECT_ATTRIBUTES objAttr;
InitializeObjectAttributes(&objAttr, &objName, OBJ_CASE_INSENSITIVE, NULL, NULL);
NTSTATUS status = NtOpenSection(&hSection, SECTION_MAP_READ | SECTION_MAP_EXECUTE, &objAttr);
if (NT_SUCCESS(status)) {
// Map the section into the current process
PVOID mappedBase = NULL;
SIZE_T viewSize = 0;
status = NtMapViewOfSection(hSection, GetCurrentProcess(), &mappedBase, 0, 0, NULL, &viewSize, ViewShare, 0, PAGE_READONLY);
// 'mappedBase' now points to a clean copy of ntdll.
NtClose(hSection);
}
On Linux, while a different paradigm, the concept of avoiding hooks can be appreciated by understanding LD_PRELOAD, a technique used to intercept library calls. A red teamer could use a custom `LD_PRELOAD` library to override system functions, which is analogous to how EDRs hook functions on Windows.
2. Navigating the Pitfalls of EDR Unhooking
This technique, while powerful, is not a silver bullet. Operators must be aware of several key pitfalls that can lead to detection or operational failure. Each pitfall requires a unique mitigation strategy. Joas A. Santos, in his LinkedIn post, highlights three major “gotchas” that can break this technique.
Step-by-Step Guide: Identifying and Mitigating Pitfalls
- Mitigating File Read Monitoring: If your code simply reads `ntdll.dll` from
C:\Windows\System32, an EDR with file system monitoring can alert on this suspicious behavior. Solution: Use the alternative method described above, pulling the DLL from the `\KnownDlls` section, which is a less-monitored memory-mapped location for system DLLs. - Avoiding Dependency Issues: If you only remap
ntdll.dll, other critical DLLs like `kernel32.dll` will still be hooked because they are loaded from the process’s default, hooked version. Any calls you make through those libraries will still trigger the EDR. Solution: You must ensure that all your critical, sensitive function calls go directly through your clean `ntdll` copy. This often means re-implementing the logic or redirecting calls to avoid using the hooked `kernel32` altogether. - Understanding ETW Still Works: This is a critical point. EDR Unhooking only removes user-mode hooks. It does nothing to prevent Event Tracing for Windows (ETW) from logging your activity. Your clean `ntdll` still makes system calls (syscalls) into the kernel, and the kernel-level ETW providers will log those events, potentially alerting a defender.
- The Multi-Layer Approach: Because of these limitations, no single evasion technique is sufficient. In his testing, Santos combined his unhooking method with ETW patching and API hashing to create a triple-layer evasion approach that has proven reliable.
-
Essential Courses for Mastering Red and Purple Team Operations
To truly understand and counter the defensive measures discussed, formal training is invaluable. Joas A. Santos, as the founder of Red Team Leaders, has developed a comprehensive suite of courses that cover everything from the fundamentals to advanced offensive development. These courses are a direct result of turning his PDF materials into structured learning paths, accelerated by AI to streamline content production.
| Course Name | Description |
| : | : |
| AV/EDR Evasion Practical Techniques | Hands-on techniques for bypassing Antivirus and EDR solutions. |
| Introduction to Red Team Operation Management | Covers planning, executing, and managing a full red team engagement. |
| Offensive Development Introduction for Windows | Foundational skills for developing custom offensive tools on the Windows platform. |
| Windows API for Red Team Introduction | Learn to leverage native Windows APIs for red team operations. |
| Purple Team – Active Directory and AzureAD v1 | Focuses on collaborative defense testing in hybrid AD/Azure environments. |
To access these 15+ courses, visit the subscription link provided by Red Team Leaders for free access.
In addition to these, the industry offers several other high-caliber certifications and training paths for those looking to specialize in red teaming:
- Offensive Security: Their OSEP (Evasion and Persistence) certification exam preparation training is a go-to for advanced operators looking to validate their skills.
- SANS Institute: The SEC565: Red Team Operations and Adversary Emulation course is a 6-day, hands-on class that leverages the MITRE ATT&CK framework and cutting-edge AI to teach students how to build resilient attack infrastructure and bypass modern defenses.
- Hack The Box (HTB): For those interested in the intersection of AI and red teaming, the new HTB Certified Offensive AI Expert (HTB COAE) certification provides a 7-day practical assessment in realistic AI-powered environments.
4. Operational Security (OPSEC) for Red Team Infrastructure
A successful red team operation hinges not only on the tools used but on the security of the infrastructure itself. OPSEC failures can lead to the entire operation being burned, exposing the team’s tactics, techniques, and procedures (TTPs). This is a critical skill that many training courses, including SANS SEC565, emphasize.
Step-by-Step Guide: Hardening Your C2 Redirectors
Command and Control (C2) redirectors are often the first point of contact with a target environment and thus a high-value target for blue teams. A common and effective tool for this is nginx.
- Filtering Traffic: The most important rule is to ensure your redirector only forwards traffic that matches your specific beacon’s profile. This prevents random internet scanners or security researchers from discovering your C2.
- Example `nginx` Configuration: Use the `location` directive to check for a specific User-Agent, URI path, or custom HTTP header that your implant uses. The following blocks any other request that doesn’t match.
/etc/nginx/sites-available/redirector.conf
server {
listen 443 ssl;
server_name your-c2-domain.com;
location / {
Only allow requests with a specific secret user-agent
if ($http_user_agent !~ "^(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 . Safari/537.36)$") {
return 404;
}
Also block if the request doesn't have a specific header
if ($http_x_custom_header != "SuperSecretValue") {
return 404;
}
Forward valid requests to your actual C2 server
proxy_pass https://your-internal-c2-server:443;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
3. Blocking Everything Else: Ensure your firewall only allows outbound connections from the redirector to your C2 server and inbound HTTPS traffic from the internet. All other ports should be closed.
4. Regular Audits: Periodically check your own redirector’s logs for any unauthorized access attempts. This can give you early warning that your infrastructure has been discovered.
- The Role of Purple Teaming in Mature Security Programs
While red teams attack and blue teams defend, purple teams exist to bridge the gap, ensuring that the lessons learned from red team exercises are effectively translated into improved defenses. Joas A. Santos discusses this integration in his workshop material, focusing on validating controls, testing detections, and tuning SIEM/EDR rules through iterative offensive-defensive cycles.
Step-by-Step Guide: Conducting an Effective Purple Team Exercise
- Define Objectives: Start by selecting a specific attack scenario, such as a Credential Dumping or Pass-the-Hash attack. This is not about a full, untethered red team operation.
- Collaborative Setup: The red and blue teams sit together. The red team prepares to execute the first step of the attack scenario on a test target.
- Execute and Observe: The red team executes the technique while the blue team watches their EDR, SIEM, or other logging tools in real-time to see which, if any, alerts are generated.
- Tune and Iterate: If an alert was not generated, the teams work together to understand why. Was the logging misconfigured? Are there detection gaps in the EDR policy? The teams make the necessary adjustments and then re-run the exact same step to validate the fix.
- Generate Artifacts: The final output of a purple team exercise is not just a report, but a set of validated detection rules (e.g., YARA rules, Sigma rules), enriched with specific indicators of compromise (IOCs) that will reliably find that TTP in the future.
What Undercode Say:
- Unhooking is a Piece of the Puzzle: EDR Unhooking is a powerful technique, but it is not an all-encompassing bypass. As our analysis shows, it must be combined with ETW patching and other tradecraft to be truly effective in a modern environment. The combination of unhooking, ETW patching, and API hashing proved reliable in testing, demonstrating the necessity of a multi-layered approach to evasion.
- Continuous Learning is the Only Constant: The rapid evolution of EDR and the expanding role of AI in both offense and defense mean that static knowledge has a short half-life. Formal training and hands-on labs are essential for keeping skills sharp and staying ahead of security controls.
Prediction:
As enterprise defenses increasingly incorporate AI and machine learning for behavioral detection, the reliance on static signature-based hooks will diminish. EDRs of the near future will likely move away from user-mode hooking towards deeper, VMI-based (Virtual Machine Introspection) monitoring that is impervious to `ntdll` remapping. This will force red teamers to pivot from unhooking techniques and master the art of mimicking normal, legitimate user behavior while blending into the non-malicious “noise” of a network. The focus will shift from evasion to sophisticated social engineering and living-off-the-land (LotL) tactics.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Joas Antonio – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
