> For the complete documentation index, see [llms.txt](https://www.scriptchildie.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/1.-what-are-userland-hooks.md).
# 1. What are userland hooks?
\#EDREvasion #UserlandHooks
Userland hooks are a technique used to intercept and modify the execution of a function in user mode. This can be used for a variety of purposes, such as monitoring and debugging applications, or injecting malicious code into a running process.
Malicious attackers use this technique to inject malicious code and legitimate software use hooking for debugging and monitoring.
### Malicious implementation
[RdpThief](https://github.com/0x09AL/RdpThief) is a dll that can be injected in the mstsc.exe (RPD client) process to identify the target host, username and password. It achieves that by hooking 3 functions:
* [*CredIsMarshaledCredentialW*](https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-credismarshaledcredentialw)
* [*CryptProtectMemory* ](https://learn.microsoft.com/en-us/windows/win32/api/dpapi/nf-dpapi-cryptprotectmemory)
* [SspiPrepareForCredRead](https://learn.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-sspiprepareforcredread)
To hook these functions the [detours package](https://github.com/microsoft/Detours) developed by Microsoft is used. It uses a technique called Inline Hooking. Inline Hooking involves inserting code into the application's code at the entry point of the function that you want to hook. This code will then call your hook function in order to extract the host, username and password before continuing with the execution of the original function.
The user logging to the remote system will have no way of knowing that this action took place unless it's picked up by an AV solution installed on the endpoint.
The extracted information are then written to disk.
### EDR Implementation
EDR solutions use the same techniques to determine if a function is used for a malicious purpose. The same pattern is following:
* Inject an EDRVendor.dll in the newly created process
* Install inline hooks on frequently abused functions.
* Determine if the function is abused for malicious purpose, and if not continue execution of the original function
Let's see how an unhooked function from ntdll looks like in memory.
{% code title="function without hooks" lineNumbers="true" %}
```
0:015> u ntdll!NtAdjustPrivilegesToken
ntdll!NtAdjustPrivilegesToken:
00007ffa`a898f560 4c8bd1 mov r10,rcx
00007ffa`a898f563 b841000000 mov eax,41h
00007ffa`a898f568 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
00007ffa`a898f570 7503 jne ntdll!NtAdjustPrivilegesToken+0x15 (00007ffa`a898f575)
00007ffa`a898f572 0f05 syscall
00007ffa`a898f574 c3 ret
00007ffa`a898f575 cd2e int 2Eh
00007ffa`a898f577 c3 ret
```
{% endcode %}
Without going into too much detail this is how an unhooked function looks like in a debugger.
Let's see how the exact same function looks like on a host with an EDR installed.
0:007> u ntdll!NtAdjustPrivilegesToken
ntdll!NtAdjustPrivilegesToken:
00007ff9`b062f460 e9932957bd jmp 00007ff9`6dba1df8
00007ff9`b062f465 cc int 3
00007ff9`b062f466 cc int 3
00007ff9`b062f467 cc int 3
00007ff9`b062f468 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
00007ff9`b062f470 7503 jne ntdll!NtAdjustPrivilegesToken+0x15 (00007ff9`b062f475)
00007ff9`b062f472 0f05 syscall
00007ff9`b062f474 c3 ret
We can see that on the hooked function on line 3 there is a jmp instruction to an address. This essentially is how a hook looks like. The destination address will do some processing on behalf of the EDR to identify if there is any malicious intend.
In the upcoming blogs we will explore how we can bypass these hooks.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/1.-what-are-userland-hooks.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.