Grixba ntdll EDR Unhook via VirtualProtect PAGE_READWRITE on ntdll.dll

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects VirtualProtect API calls that change the memory protection of ntdll.dll to PAGE_READWRITE. This behavior is commonly associated with EDR unhooking techniques where malware removes hooks placed by security products to monitor system API calls.