Suspicious ntdll.dll file access by CRPx0 stager binaries (unhooking)

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

Detects instances where specific suspicious or known-malicious processes load 'ntdll.dll' from the 'System32' directory. This behavior is indicative of potential DLL side-loading, process injection, or evasive execution patterns where an attacker leverages legitimate system binaries to load malicious code.