Home / Series / DEF CON / Aired Order / Season 32 / Episode 73

HookChain: A new perspective for Bypassing EDR Solutions

In the current digital security ecosystem, where threats evolve rapidly and with complexity, companies developing Endpoint Detection and Response (EDR) solutions are in constant search for innovations that not only keep up but also anticipate emerging attack vectors. In this context, this article introduces the HookChain, a look from another perspective at widely known techniques, which when combined, provide an additional layer of sophisticated evasion against traditional EDR systems. Through a precise combination of IAT Hooking techniques, dynamic SSN resolution, and indirect system calls, HookChain redirects the execution flow of Windows subsystems in a way that remains invisible to the vigilant eyes of EDRs that only act on Ntdll.dll, without requiring changes to the source code of the applications and malwares involved. This work not only challenges current conventions in cybersecurity but also sheds light on a promising path for future protection strategies.

English
  • Originally Aired August 10, 2024
  • Runtime 45 minutes
  • Created August 25, 2024 by
    Subscriber-2473783
  • Modified August 25, 2024 by
    Subscriber-2473783