.NET Loader - NTDLL Memory Patching for EDR Evasion
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, a known evasion tactic to blind EDR telemetry before full execution. This rule specifically looks for WriteProcessMemory API calls targeting memory regions near the base address of ntdll.dll, initiated by processes like InstallUtil.exe, MSBuild.exe, or powershell.exe.
Microsoft Sentinel (KQL)
