New Obex Tool Blocks EDR Dynamic Libraries From Loading at Runtime
A new proof-of-concept (PoC) tool named Obex has been introduced, providing a mechanism to prevent Endpoint Detection and Response (EDR) systems and other monitoring solutions' dynamic-link libraries (DLLs) from being loaded into processes.
A new proof-of-concept (PoC) tool named Obex has been introduced, providing a mechanism to prevent Endpoint Detection and Response (EDR) systems and other monitoring solutions' dynamic-link libraries (DLLs) from being loaded into processes.
Developed by the researcher known as "dis0rder0x00," Obex is designed to block specified DLLs during both process startup and runtime. This capability enables malware or red team tools to potentially operate without detection by security software.
Obex operates by launching a target application under its debug control, allowing it to intercept critical system operations. It specifically hooks the ntdll!LdrLoadDll function, responsible for loading DLLs into a process. When an application attempts to load a DLL, Obex intercepts the call and checks the DLL’s name against a configurable blocklist. If the DLL is on the list, the tool simulates a failed load attempt, preventing the library from being injected. If the DLL is not on the list, the loading process continues normally. This technique effectively prevents security tools that rely on DLL injection from monitoring process behavior.
Developed by the researcher known as "dis0rder0x00," Obex is designed to block specified DLLs during both process startup and runtime.
The tool is implemented in C and has no external dependencies, ensuring it remains lightweight and portable. By default, Obex is configured to block amsi.dll , the library for the Antimalware Scan Interface . Users may also provide a custom list of DLLs to block.
The developer has made the tool available on GitHub, positioning it as a technique for security researchers to explore and test evasion methods. Security solutions often use DLL injection to establish user-mode hooks for monitoring API calls and system behavior. Tools like Obex illustrate methods to circumvent these defenses.
While the tool is valuable for penetration testers and red teams, it also provides defenders and security vendors with insights into evasion techniques. This understanding aids in developing more resilient detection and protection strategies against sophisticated threats.
Based on reporting by Cyber Security News.