
Experimenting with x64 Assembly to Evade NDR and EDR Detection
CybersecurityHackingEvasionTechniquesAssemblyLanguage
I was tired of NDRs and EDRs flagging every C2 I tried, so I spent a month in x64 Assembly to see if pure syscalls actually make a difference. The post describes an experiment where the author wrote custom x64 Assembly code to test whether using direct syscalls could evade detection by Network Detection and Response (NDR) and Endpoint Detection and Response (EDR) systems. The author references a linked blog post about an ICMP-based Command and Control (C2) technique. The focus was on bypassing security tools by avoiding higher-level API calls.