Suspicious CallTrace via Unbacked Memory Invoking ntdll Syscall Gadget

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects suspicious process access attempts targeting common web browsers (chrome, msedge, firefox) using high-privilege access masks (such as 0x1F0FFF or 0x1FFFFF). The detection is specifically scoped to calls originating from unbacked memory (indicated by an UNKNOWN stack trace entry containing ntdll.dll), which is a common indicator of direct or indirect syscalls used by malware for stealthy memory access, such as credential theft or session cookie exfiltration.