Well, Sentinel1 is the first EDR I've seen doing this. The who | Malware News
Well, Sentinel1 is the first EDR I've seen doing this. The whole Export Address Table (EAT) is modified in memory for kernel32.dll and not just the WinAPI calls. So, if you are trying to parse kernel32 to find any export function, you will be forever stuck in a loop... lol! NinjaParanoid
