ntdll.dll unhooking

Named by 2 kept items in this workspace.

Search every workspace for ntdll.dll unhooking. It matches the name as written, so it can find other things that share it.

The items that name it 2

Field Notes: Reconstructing the Attacker's LSASS Dump
writeup2026-09-30
TrickDump supports multiple techniques (disk, knowndlls, debugproc) for overwriting the .text section of ntdll.dll to bypass user-mode API hooks
DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
writeup2026-06-08It is written here as ntdll.dll unhooking (PAGE_READWRITE modification).
All four Grixba versions modify ntdll.dll memory protection to PAGE_READWRITE to unhook EDR instrumentation.

All techniques in this workspace.