Skip to content
λmaldev wiki/
pagesEvasion & Unhooking

Evasion & Unhooking

Everything aimed at the sensor rather than the target: stripping userland hooks, blinding telemetry, and hiding a beacon between check-ins.

12 techniques
T1027
IAT Obfuscation
Hide imported API calls from static analysis by resolving function addresses at runtime instead of declaring them in the PE import table.
T1027.007
Heap / Stack Encryption During Sleep
Encrypt the beacon's own memory while it sleeps so in-sleep memory scans find nothing recognisable.
T1027.007
Sleep Obfuscation
Encrypt a beacon's own memory while it waits between check-ins, so scanners find nothing.
T1027.011
Control Flow Obfuscation
Restructure a binary's control flow graph to defeat static analysis and signature detection without changing its runtime behaviour.
T1036.005
Call Stack Spoofing
Fabricate a plausible-looking call stack to hide the true origin of API calls made from shellcode or an injected beacon.
T1036.007
Module Overloading
Load a legitimate DLL into memory and overwrite its executable sections with a shellcode payload, inheriting the module's backed memory status.
T1106
Direct & Indirect Syscalls
Skip the ntdll export table entirely by issuing the syscall instruction yourself.
T1134.004
Parent PID Spoofing
Set an arbitrary parent process handle when creating a new process to fool parent-child heuristics.
T1562.001
AMSI Bypass
Patch or neutralise the Antimalware Scan Interface so PowerShell and .NET payloads run uninspected.
T1562.001
Indirect Syscalls & Hell's Gate
Dynamically resolve System Service Numbers at runtime and call them via trampolines in ntdll, bypassing EDR hooks without patching ntdll.
T1562.001
Unhooking ntdll
Restore a clean copy of ntdll from disk to strip userland EDR hooks.
T1562.006
ETW Patching & Disabling
Disable Event Tracing for Windows (ETW) in the current process by patching the EtwEventWrite function in ntdll, preventing security tools from receiving ETW telemetry.