API unhooking via Perun's Fart

/static/assets/windows-logo.svg
This TTP will create a new process in a suspended state, create a clean version of `ntdll.dll`, and overwrite the `ntdll.dll` from the current process to unhook it. After `ntdll.dll` is unhooked, the shellcode is executed to spawn calc.exe.
locked
View Command

To view this TTPs command, you must be logged in with a professional or enterprise license.

Login

Test this TTP

Download Operator (1.7.0)
Test this TTP using one of our Operator chains
API unhooking via Perun's Fart

2022-10-04

/static/assets/windows-logo.svg
API unhooking by overwriting the current process version of the DLL.