(In)direct Syscalls: A journey from high to low

Abstract

Over the last 2-3 years, detection of in-memory malware by EDRs has improved. Depending on the EDR, they use different defenses such as user mode hooks, callbacks, or Event Viewer for Windows (ETW) to detect in-memory threats. Therefore, among others or depending on the EDR, from an attacker’s (red team’s) perspective, we must use different types of techniques such as direct sycalls, indirect sycalls, or call stack spoofing to avoid being detected by EDRs.

The goal of this talk is to give a brief, logical overview of syscalls in general on Windows, direct syscalls, indirect syscalls, etc. We will take a step-by-step look at how to develop a Win32 API shellcode loader into an indirect syscall shellcode loader. We will go through Win32 APIs, Native APIs, direct syscalls, and indirect syscalls. We will look at when direct syscalls fail to bypass EDRs and why indirect syscalls are an evolution of direct syscalls and can be used to bypass them, depending on the EDR. We will also do some call stack analysis and look at the limitations of indirect syscalls in the context of EDR evasion, when they fail, and why it may be necessary to spoof the entire call stack of your shellcode loader to evade an EDR in 2023.