--- title: Silly EDR Bypasses and Where To Find Them | daily.dev description: Marcus Hutchins explores two novel techniques to bypass EDR (Endpoint Detection and Response) user-mode hooks without triggering callstack-based detections.... canonical: https://daily.dev/posts/silly-edr-bypasses-and-where-to-find-them-h6edcdbfb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Silly EDR Bypasses and Where To Find Them | daily.dev og:description: Marcus Hutchins explores two novel techniques to bypass EDR (Endpoint Detection and Response) user-mode hooks without triggering callstack-based detections.... og:url: https://daily.dev/posts/silly-edr-bypasses-and-where-to-find-them-h6edcdbfb og:image: https://api.daily.dev/og/posts/H6EDcdbFb.png og:image:alt: Silly EDR Bypasses and Where To Find Them og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Silly EDR Bypasses and Where To Find Them **[MalwareTech](https://daily.dev/sources/malwaretech)** · 14 min read · 0 upvotes · 0 comments ## Summary Marcus Hutchins explores two novel techniques to bypass EDR (Endpoint Detection and Response) user-mode hooks without triggering callstack-based detections. The first method uses hardware breakpoints placed on the syscall and return instructions of hooked Nt functions, allowing an exception handler to swap benign parameters for malicious ones after the EDR has already inspected them. The second method intentionally passes an invalid memory address to trigger a CPU exception inside the EDR's hook handler, then uses an exception handler to fix the stack and redirect the EDR's pointer inspection to a fake empty context structure. Both techniques are demonstrated against Sophos Intercept X's process hollowing detection, with a working proof-of-concept published on GitHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [How the GodDamn Ransomware Driver Bypasses Your EDR](https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu) · Latest Hacking News · 0 upvotes · 0 comments - [The EDR blind spot: 3 ways browser attacks evade endpoint telemetry](https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y) · BleepingComputer · 0 upvotes · 0 comments - [What the Nike Breach Teaches Us About the Microsegmentation Imperative of Integrating with EDR](https://daily.dev/posts/what-the-nike-breach-teaches-us-about-the-microsegmentation-imperative-of-integrating-with-edr-itcmt7cby) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#offensive-security](https://daily.dev/tags/offensive-security) [View this post on daily.dev](https://daily.dev/posts/silly-edr-bypasses-and-where-to-find-them-h6edcdbfb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Silly EDR Bypasses and Where To Find Them","url":"https://daily.dev/posts/silly-edr-bypasses-and-where-to-find-them-h6edcdbfb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/silly-edr-bypasses-and-where-to-find-them-h6edcdbfb"},"datePublished":"2026-03-31T12:26:29.256Z","dateModified":"2026-03-31T12:32:37.549Z","description":"Marcus Hutchins explores two novel techniques to bypass EDR (Endpoint Detection and Response) user-mode hooks without triggering callstack-based detections....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4fda41709d763f467c8994b6aaf4025d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4fda41709d763f467c8994b6aaf4025d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"MalwareTech","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"MalwareTech","logo":"https://media.daily.dev/image/upload/s--Io6vLwog--/f_auto,q_auto/v1774960089/logos/malwaretech?_a=BAMAMiWQ0","url":"https://daily.dev/sources/malwaretech"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/silly-edr-bypasses-and-where-to-find-them-h6edcdbfb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"offensive-security","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"MalwareTech","item":"https://daily.dev/sources/malwaretech"},{"@type":"ListItem","position":3,"name":"Silly EDR Bypasses and Where To Find Them"}]} ```