LazyHook: New Framework Uses Hardware Breakpoints to Bypass EDR Stealthily
A newly released open-source project has drawn the attention of the technical community for its attempt to circumvent modern workstation protection mechanisms. A developer using the alias hwbp has published a framework called LazyHook on GitHub, showcasing a stealthy method for intercepting system functions through hardware breakpoints and structured exception handling. This technique enables the execution of arbitrary code within a trusted call chain, effectively misleading behavioral monitoring systems.
The project description notes that many defensive solutions analyze call origins, verify the digital signatures of loaded modules, and track suspicious sequences of system calls. LazyHook manipulates execution context in such a way that operations appear to originate from a Microsoft library rather than a third-party component. Because the method leaves process memory untouched, integrity checks fail to detect the intrusion.
The author emphasizes the combined use of hardware debug registers and execution redirection via single-step exceptions. In this mode, an exception handler monitors access to a target function, briefly diverts execution to predefined logic, and then seamlessly returns control to the original code path. To preserve correct application behavior, the framework also allows the original function to be invoked without an active breakpoint.
The repository includes several illustrative examples. One demonstrates interference with MessageBoxA by altering the displayed text. Another shows the interception of CreateFileA to log file operations without disrupting the application’s normal behavior. A separate example targets the AMSI mechanism, artificially marking scanned content as safe. The authors stress that these demonstrations highlight the risks faced by security systems that rely too heavily on trusted call chains.
The developer underscores that such techniques are intended solely for legitimate purposes, ranging from educational use to attack simulation in controlled environments. He cautions that attempting to apply these methods to bypass real-world security controls without authorization constitutes a violation of the law.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
