Operation Bypass: Catch My Payload If You Can
Matthew Eidelberg breaks down the mechanics of modern EDR evasion, demonstrating API unhooking, AMSI bypasses, and indirect system calls in offensive payloads.
Summary
The Mechanics of Endpoint Detection and Response (EDR)
Modern EDR agents monitor process execution by injecting user-mode DLLs, hooking Win32 APIs, and subscribing to Event Tracing for Windows (ETW) and AMSI telemetry.
Bypassing User-Mode API Hooks and AMSI
Matthew Eidelberg walks through advanced payload evasion techniques, including patching Antimalware Scan Interface (AMSI) buffers and unhooking loaded ntdll.dll modules.
Implementing Direct and Indirect System Calls
By invoking direct and indirect system calls (Syswhispers/Hell's Gate), offensive payloads bypass userland API hooks entirely, communicating directly with the Windows kernel.
Defensive Engineering and Kernel-Level Visibility
Eidelberg advises defensive teams on relying on kernel-level telemetry (ETW Threat Intelligence, kernel callbacks) rather than fragile user-mode hooks.
Related talks
Main Stage·27 min
Asaf Gilboa · Ron Ben-Yitzhak
Asaf Gilboa and Ron Ben-Yitzhak present a stealthy credential dumping technique that abuses native Windows Error Reporting (WER) to dump LSASS without alerts.
Main Stage·26 min
Tarek Abdelmotaleb · Bramwell Brizendine
Tarek Abdelmotaleb and Dr. Bramwell Brizendine demonstrate weaponizing Windows syscalls into pure position-independent shellcode, evading modern EDR hooks.
Red Team Village·1 hr
Eduardo Arriols
Eduardo Arriols breaks down stealthy backdoor deployment and persistent access techniques across enterprise Windows networks, evading blue team hunts.