The POC was to implement and reverse natively this : Hiding In PlainSight - Proxying DLL Loads To Hide From ETWTI Stack Tracing. Making a minimal exe and no imports. NtAllocateVirtualMemory was used as example (same in the article). It uses direct syscalls to interact with ntdll. It could be combined with indirect syscall + stack spoof to add evasion.
- NtCreateIoCompletion
- NtCreateEvent
- NtCreateWorkerFactory
- NtSetInformationWorkerFactory
- NtWorkerFactoryWorkerReady
- NtSetIoCompletion
- NtRemoveIoCompletion
- NtReleaseWorkerFactoryWorker
- NtShutdownWorkerFactory
- NtClose
- NtWaitForSingleObject (For debugging)
- NtDelayExecution (For debugging)
