Grixba ntdll EDR Unhooking via VirtualProtect PAGE_READWRITE Memory Modification

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects modifications to the memory protection flags of the ntdll.dll library to PAGE_READWRITE (0x04). This behavior is commonly associated with shellcode injection, hooking, or patching of core system libraries to facilitate malicious activity or evasion.