PEB Walk: Avoid API calls inspection in IAT by analyst and bypass static detection of AV/EDR

This post details techniques to bypass static analysis by AV/EDR solutions, focusing on process environment block (PEB) walking to hide API calls and obfuscate imports. It walks through stages of developing malware to evade detection, from simple injection to advanced PEB walk and API obfuscation, highlighting the inspection process and results at each stage.