  In the current digital security ecosystem, where threats evolve rapidly and
with complexity, companies developing Endpoint Detection and Response (EDR)
solutions are in constant search for innovations that not only keep up but also
anticipate emerging attack vectors. In this context, this article introduces
the HookChain, a look from another perspective at widely known techniques,
which when combined, provide an additional layer of sophisticated evasion
against traditional EDR systems. Through a precise combination of IAT Hooking
techniques, dynamic SSN resolution, and indirect system calls, HookChain
redirects the execution flow of Windows subsystems in a way that remains
invisible to the vigilant eyes of EDRs that only act on Ntdll.dll, without
requiring changes to the source code of the applications and malwares involved.
This work not only challenges current conventions in cybersecurity but also
sheds light on a promising path for future protection strategies, leveraging
the understanding that continuous evolution is key to the effectiveness of
digital security. By developing and exploring the HookChain technique, this
study significantly contributes to the body of knowledge in endpoint security,
stimulating the development of more robust and adaptive solutions that can
effectively address the ever-changing dynamics of digital threats. This work
aspires to inspire deep reflection and advancement in the research and
development of security technologies that are always several steps ahead of
adversaries.
  UNDER CONSTRUCTION RESEARCH: This paper is not the final version, as it is
currently undergoing final tests against several EDRs. We expect to release the
final version by August 2024.
