Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll , and trigger exported API from the export table
RATandC2/FilelessNtdllReflection
Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|