Direct syscalls test

SysWhispers2 payload

Executes a payload with direct syscalls (SysWhispers2) on the test host, validating detection of evasion via native calls.

Run it in the purple team lab when you want to validate the layer against direct syscalls: the payload with SysWhispers2 (system calls without going through hooked ntdll) bypasses EDR user-mode hooks, and the team verifies what was detected — the EDR rules (behavior, kernel), the SIEM ones. It's the validation of modern EDR evasion: direct syscalls are the technique of current loaders. In purple teaming, SysWhispers2 validates if the EDR layer detects activity without the hooks — the 'not detected' result is the common finding and the starting point for kernel layers.

Do not run it outside the lab: the payload with syscalls is real evasion — the test host is the place. And note: direct syscalls bypass user-mode hooks — the validation measures if the EDR detects by behavior (the anomalous syscall, the result) or by the kernel; many don't see it (the documented gap). The payload is compiled with SysWhispers2 (the generated stubs) — compilation is part of the exercise. Cleanup when done.