In the current digital security ecosystem, where threats evolve rapidly and with complexity, companies developing Endpoint Detection and Response (EDR) solutions are in constant search for innovations that not only keep up but also anticipate emerging attack vectors. In this context, this article introduces the HookChain, a look from another perspective at widely known techniques, which when combined, provide an additional layer of sophisticated evasion against traditional EDR systems. Through a precise combination of IAT Hooking techniques, dynamic SSN resolution, and indirect system calls, HookChain redirects the execution flow of Windows subsystems in a way that remains invisible to the vigilant eyes of EDRs that only act on Ntdll.dll, without requiring changes to the source code of the applications and malwares involved. This work not only challenges current conventions in cybersecurity but also sheds light on a promising path for future protection strategies, leveraging the understanding that continuous evolution is key to the effectiveness of digital security. By developing and exploring the HookChain technique, this study significantly contributes to the body of knowledge in endpoint security, stimulating the development of more robust and adaptive solutions that can effectively address the ever-changing dynamics of digital threats. This work aspires to inspire deep reflection and advancement in the research and development of security technologies that are always several steps ahead of adversaries. UNDER CONSTRUCTION RESEARCH: This paper is not the final version, as it is currently undergoing final tests against several EDRs. We expect to release the final version by August 2024.

翻译：在当前网络威胁迅速演变且日益复杂的数字安全生态系统中，端点检测与响应（EDR）解决方案的开发企业持续探索创新技术，既要应对现有威胁，更要预判新兴攻击向量。在此背景下，本文提出HookChain技术——通过重新审视并组合多项广泛应用的已知技术，为传统EDR系统构建了高阶规避层。该技术精准结合IAT挂钩、动态SSN解析与间接系统调用，以对仅监控Ntdll.dll的EDR系统保持透明的方式，重定向Windows子系统执行流，且无需修改相关应用程序或恶意软件的源代码。本研究不仅挑战了网络安全领域的现行惯例，更揭示了未来防护策略的前沿方向——深刻理解"持续进化是数字安全有效性的核心"。通过开发与探索HookChain技术，本文为终端安全知识体系作出重要贡献，推动开发更加强健、更具适应性的解决方案以有效应对数字威胁的动态演变。本研究旨在激发安全技术研发领域的深层反思与突破，确保防护能力始终领先攻击者一步。**研究进行中**：本文为预发布版本，目前正在针对多个EDR系统进行最终测试。预计于2024年8月发布正式版本。