CRPx0/EDR Bypass: ntdll.dll Read from Disk for Syscall Unhooking

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects processes attempting to read the ntdll.dll file directly from the disk, a technique commonly associated with EDR bypass attempts where adversaries map a fresh copy of the library to overwrite hooked syscall functions (e.g., NtAllocateVirtualMemory/NtWriteVirtualMemory) to evade detection. The rule excludes common, legitimate system processes that may legitimately access this file during startup or normal operation.