Evasion & Unhooking
Everything aimed at the sensor rather than the target: stripping userland hooks, blinding telemetry, and hiding a beacon between check-ins.
3 techniques
T1027.007Windows07-19T1106Windows07-08T1562.001Windows07-19
Sleep Obfuscation
Encrypt a beacon's own memory while it waits between check-ins, so scanners find nothing.
Direct & Indirect Syscalls
Skip the ntdll export table entirely by issuing the syscall instruction yourself.
Unhooking ntdll
Restore a clean copy of ntdll from disk to strip userland EDR hooks.
no techniques match those filters.