07/14/2026
If security tools only monitor standard API calls, what happens when attackers skip them entirely?
Our new demo covers direct syscalls, a technique that bypasses traditional antivirus hooks by communicating directly with the Windows kernel. We walk through manually extracting syscall numbers, automatically building the code with SysWhispers3, and executing a Havoc C2 beacon.
🔗 Blog: https://www.rbtsec.com/blog/direct-syscalls-in-practice-bypassing-userland-edr-hooks-with-windbg-syswhispers3-havoc-c2/
🔗 Demo: https://www.youtube.com/watch?v=LA5ls9mDCzQ
Direct syscalls let malware bypass userland EDR hooks by calling the Windows kernel directly. Instead of going through the heavily hooked ntdll.dll stubs, the implant builds its own clean syscall stub (mov r10, rcx; mov eax, SSN; syscall; ret).
