Indirect syscalls are a stealthy Windows execution technique that tries to bypass common user-mode monitoring. Normally, security products can watch application calls into the Windows API and spot suspicious behavior. With indirect syscalls, malware reaches the underlying system service in a less obvious way, often by jumping through a separate stub or an intermediary code path instead of calling the usual function directly.
This matters because many endpoint defenses place hooks in user space to inspect process activity, memory operations, and security-related actions. If malware can avoid those hooks, it may reduce telemetry and delay detection. Attackers use indirect syscalls in loaders, injectors, and post-exploitation tools to make malicious behavior harder to observe. Defenders look for unusual syscall patterns, suspicious memory execution, tampering with security tools, and signs of other evasion layers such as BYOVD or process injection. Indirect syscalls do not make malware invisible, but they can make investigation and detection harder.