“According to the research published by Hackmosphere, the technique works by avoiding the conventional execution path where applications call Windows API functions through libraries like kernel32.dll, which then forwards requests to ntdll.dll before making the actual system call to the kernel.”
Additional Information:
https://www.hackmosphere.fr/bypass-windows-defender-antivirus-2025-part-1/
https://www.hackmosphere.fr/bypass-windows-defender-antivirus-2025-part-2/
They also suggest organizations deploy additional security layers beyond Windows Defender, particularly solutions that can monitor behavior at the kernel level.
Anything like this for the typical home user?
Sure, bring back Crowdstrike, that went well…
Btw I wasn’t aware XOR was encrytion…
https://en.wikipedia.org/wiki/One_time_pad
XOR may be the only encryption system that cannot be cracked. The length of the key is a PITA though.
It technically counts. It’s a cipher that uses the same key for encryption and decryption.
A one time pad, I think it called.
deleted by creator
Btw I wasn’t aware XOR was encrytion…
It’s even better than ROT13, because you always need to apply ROT13 twice for getting the good results…
According to the research published by Hackmosphere, […]
I cannot find a link to the original research, anybody has the link to the original research?
Saw this attack in the wild this week. Huntress MDR detected and shut it down.
