EDR unhooking test

SharpBlock.exe # → NTDLL unhook

Run SharpBlock on the test host to unhook NTDLL, validating whether the EDR detects (or blocks) the unhooking.

Run it in the purple team lab when you want to validate the layer against unhooking: SharpBlock restores clean sections of NTDLL (removing EDR hooks) and the team verifies what was detected — EDR rules (NTDLL modification), SIEM rules, behavior. This is EDR evasion validation: if the unhooking goes undetected, the rest of the activity (syscalls, injection) is not seen. In purple teaming, SharpBlock validates the unhooking detection layer — one of the most used EDR evasion techniques.

Do not run it outside the lab: the process's NTDLL modification is real evasion — the test host is the place. And note: unhooking is an EDR evasion technique — the validation measures whether the lab EDR detects the section modification; many EDRs do not see it (the documented limitation of user-mode hooks) — the 'not detected' result is the expected finding in many environments, and it is the starting point for alternative detection layers (kernel, behavior). Cleanup at the end (processes with modified NTDLL are closed).