Native API EDR Unhooking (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•6

This rule detects attempts to unhook or tamper with Native APIs by monitoring 'WriteProcessMemory' calls targeting 'ntdll.dll'. This technique is often used by adversaries to evade EDR (Endpoint Detection and Response) solutions by disabling their API monitoring capabilities.