An indirect system call is a way for Windows code to invoke kernel services without calling the normal user-mode API path directly. Instead of using a standard exported function in ntdll.dll, malware may jump through a custom stub or copied syscall instruction to reach the kernel while avoiding or bypassing user-mode hooks.
This matters because many EDR and analysis tools rely on user-mode interception to observe process creation, memory allocation, protection changes, and injection behavior. By skipping those hooks, malware can make its activity harder to see, especially during loader and stager phases. Defenders often respond with kernel telemetry, ETW, memory analysis, and integrity checks for tampered API stubs or unusual syscall-heavy behavior. In real attacks, indirect syscalls are commonly used to reduce visibility during in-memory execution and other evasive actions.