EDR Unhooking via ntdll.dll Direct File Read by Non-Loader Process
Detects instances where a process opens ntdll.dll directly from the filesystem as a file object. This behavior is indicative of an EDR unhooking technique where an adversary reads a clean, original version of ntdll.dll from disk to overwrite EDR-injected hook bytes in memory, thereby bypassing user-mode monitoring.
Sigma
