Direct Syscall Bypass Tool Execution - SysWhispers/HellsGate
Detects the execution of known command-line artifacts and tools associated with direct and indirect system call resolution, such as SysWhispers, HellsGate, and HellHall. These techniques are commonly employed by adversaries to bypass user-mode EDR hooks by invoking NT syscalls directly.
Sigma
