Mar 26, 2025, 01:25 AM
Yo ghost hackers, BlackLotus here. Just joined the forum and wanted to share a technique I’ve been studying and testing lately to bypass modern AVs and EDRs: Sleep Obfuscation combined with API Unhooking. I’ve validated it against Windows Defender and CrowdStrike, and I’d love to get your feedback.
? Sleep Obfuscation
AVs monitor the Sleep() API to detect suspicious behavior, so we can swap it out with less suspicious alternatives like NtDelayExecution or system timers (SetTimer). This helps evade sandboxes that analyze executable behavior.
? API Unhooking
EDRs hook critical functions like WriteProcessMemory and CreateProcess to spot malware. To bypass this, here’s what I did:
1️⃣ Load a clean copy of ntdll.dll into memory.
2️⃣ Extract the original addresses of the targeted APIs.
3️⃣ Replace the hooked versions with the clean ones pulled straight from ntdll.
? Results
I tested this technique with a payload using process hollowing, and it flew under the radar of both Windows Defender and CrowdStrike. I haven’t tested it on more advanced EDRs like SentinelOne yet, but I think it could work with some tweaks.
? Next Steps
I’m planning to test this on SentinelOne and other advanced EDRs, and maybe add techniques like direct syscalls or ETW patching for even stealthier evasion. If you’ve got tips for those tests, I’m all ears!
What do you guys think? Have you used similar techniques to bypass AVs/EDRs? Got any tips for dealing with EDRs like SentinelOne or Carbon Black?
? Sleep Obfuscation
AVs monitor the Sleep() API to detect suspicious behavior, so we can swap it out with less suspicious alternatives like NtDelayExecution or system timers (SetTimer). This helps evade sandboxes that analyze executable behavior.
? API Unhooking
EDRs hook critical functions like WriteProcessMemory and CreateProcess to spot malware. To bypass this, here’s what I did:
1️⃣ Load a clean copy of ntdll.dll into memory.
2️⃣ Extract the original addresses of the targeted APIs.
3️⃣ Replace the hooked versions with the clean ones pulled straight from ntdll.
? Results
I tested this technique with a payload using process hollowing, and it flew under the radar of both Windows Defender and CrowdStrike. I haven’t tested it on more advanced EDRs like SentinelOne yet, but I think it could work with some tweaks.
? Next Steps
I’m planning to test this on SentinelOne and other advanced EDRs, and maybe add techniques like direct syscalls or ETW patching for even stealthier evasion. If you’ve got tips for those tests, I’m all ears!
What do you guys think? Have you used similar techniques to bypass AVs/EDRs? Got any tips for dealing with EDRs like SentinelOne or Carbon Black?