Drun/Chromelevator Direct Syscall EDR Bypass via NtAllocateVirtualMemory and NtCreateThreadEx
This rule detects the Drun loader, also known as Chromelevator, by identifying its characteristic use of direct syscalls to bypass EDR User Mode API hooking. It specifically looks for 'drun.exe' executing commands containing 'NtAllocateVirtualMemory', 'NtWriteVirtualMemory', or 'NtCreateThreadEx', or loading 'ntdll.dll' while having 'drun.exe' as the initiating process. It also identifies the presence of the 'drunko\drun\x64\Release' folder path.
Microsoft Sentinel (KQL)
