Weaponizing Windows Syscalls: Pure Syscall Shellcode & Advanced Evasion
Tarek Abdelmotaleb and Dr. Bramwell Brizendine demonstrate weaponizing Windows syscalls into pure position-independent shellcode, evading modern EDR hooks.
Summary
The Evolution of User-Mode Hooking and EDR Monitoring
Modern Endpoint Detection and Response tools place inline API hooks in user-mode DLLs (ntdll.dll, kernel32.dll) to intercept malicious API calls.
Developing Pure Syscall-Based Shellcode
Tarek Abdelmotaleb and Dr. Bramwell Brizendine present a methodology for writing pure position-independent shellcode that invokes direct system calls natively.
Resolving Dynamic Syscall Numbers Across Windows Builds
The researchers explain techniques for dynamically resolving System Service Numbers (SSNs) across diverse Windows OS versions without calling hooked APIs.
Kernel-Level Defensive Telemetry and Detection
The authors discuss defensive telemetry mechanisms—including kernel-mode ETW Threat Intelligence (ETW-TI) and memory scanning—to detect direct syscall abuse.
Related talks
Main Stage·48 min
Itzik Kotler
Comprehensive catalog of 15+ Windows process injection techniques with detection signatures and evasion analysis for each.
Main Stage·42 min
Wietze Beukema
Wietze Beukema presents novel DLL hijacking techniques that manipulate user-controlled environment variables to execute code via signed binaries with zero file drops.
Main Stage·27 min
Asaf Gilboa · Ron Ben-Yitzhak
Asaf Gilboa and Ron Ben-Yitzhak present a stealthy credential dumping technique that abuses native Windows Error Reporting (WER) to dump LSASS without alerts.