SharpHookCheek

Most EDR's hook Nt and Zw APIs to determine if a running program has malicious intent. This C# based script returns a list of currently hooked APIs.

https://gist.github.com/sbasu7241/4c2640fb6dd5bfdcfac07b83f1648ee0

#edr #hooks #csharp #maldev

⚙️ Introduction to Bypassing Hooks EDR

The article explores methods of bypassing EDR hooks in the user mode of the Windows operating system, starting with an explanation of system calls and their role in transitioning between user and kernel modes. Subsequently, various techniques for bypassing hooks are discussed, including direct and indirect syscalls, along with their advantages and potential limitations when used for evading protective mechanisms.

🔗 https://malwaretech.com/2023/12/an-introduction-to-bypassing-user-mode-edr-hooks.html

#maldev #edr #hooks #syscalls