Native API EDR Unhooking with Process Hollowing

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

This rule detects advanced evasion techniques involving the patching of Native APIs (specifically WriteProcessMemory on ntdll.dll) combined with the spawning of suspended processes (process hollowing). This combination is indicative of attempts to unhook EDRs and execute malicious code stealthily.