Evasion Indicator: Manual API Resolution via PEB Walking

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•3

This rule detects processes flagged by SentinelOne's behavioral engine with an 'Evasion' indicator. Specifically, this captures behaviors where a process performs manual module or function export enumeration (such as traversing the PEB Ldr linked list or parsing the EAT) to resolve API addresses, a technique often used to avoid standard dynamic-resolution APIs like LoadLibrary or GetProcAddress in order to bypass EDR API hooking.