COMBINING DLL SIDELOADING AND SYSCALLS FOR EVASION

Summary from the TLDR InfoSec newsletter

This article examines DLL Sideloading and using Direct Syscalls as evasion techniques to bypass Antivirus and EDR solutions by loading malicious DLLs via legitimate applications. Using hijacking and Direct Syscalls, the author shows how to create and execute a malicious DLL that evades static detection and executes shellcode on a victim machine. Elastic YARA rules and Havoc C2 are used for generating and testing shellcode, enhancing evasion against security defenses.