.NET Loader - NTDLL Memory Patching for EDR Evasion
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, blinding EDR telemetry. This rule specifically looks for WriteProcessMemory API calls targeting ntdll.dll from processes like InstallUtil.exe, MSBuild.exe, and powershell.exe, which are commonly abused for code execution and evasion.
Microsoft Sentinel (KQL)
