Direct system call Bypass

Direct system calls and evading “Mark of the Syscall”

This technique allows attackers to leverage direct system calls to evade hooks implemented in ntdll.dll using security solutions

• For example, attackers can call its kernel-equivalent NtAllocateVirtualMemory in ntdll.dll instead of calling VirtualAlloc
• Furthermore, to evade the system call directly, attackers can retrieve the syscall ID from ntdll.dll, push the arguments into the stack, and call syscall <id> instructions.