Free tools Windows power users keep installed
One-click scans. No signup required.
A direct Windows syscall executes its syscall instruction in the caller’s code; an indirect syscall transfers execution to an instruction in ntdll.dll. Both request a kernel service, and either can alter what a user-mode hook observes. Neither makes the requested activity invisible: code, memory changes, behavior, and other telemetry can still reveal it.
What a Windows syscall does
A system call is a request from user mode for a service provided by the Windows kernel. Microsoft Learn defines it as “a service provided by the kernel that can be called from user mode” and gives native examples such as NtCreateProcess, NtOpenFile, and NtTerminateProcess. The page is a WSL architectural overview, so its definition is useful here, but it should not be read as a description of every native Windows call path: Microsoft Learn: WSL architectural overview.
As an Amazon Associate I earn from qualifying purchases.
How direct and indirect syscalls differ
The terms describe where the processor executes the syscall instruction—not whether the requested operation is malicious or whether it succeeds.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Aspect | Direct syscall | Indirect syscall |
|---|---|---|
| Instruction location | The syscall instruction is in code supplied by the caller. | Execution reaches a syscall instruction in a sequence located in ntdll.dll. |
| Why it is studied | It can avoid the usual user-mode API or ntdll hook path. |
It changes the instruction’s location to a familiar system-library region and may affect user-mode telemetry. |
| Potential clue | A syscall instruction in unusual code may attract static-analysis attention. | The surrounding setup, call context, behavior, or memory provenance may still look unusual. |
| Version dependence | The relevant service number and calling details depend on the Windows build. | The service number and applicable system-library stub are also build-sensitive. |
This distinction and its tradeoffs are presented in a 2022 HITB conference primer: HITB: Introduction to Direct Syscalls. The important qualification is that changing an interception point changes one observation path; it does not establish that all security monitoring has been bypassed.
#1 Best Overall
Why malware researchers care
Understanding hook coverage
Security tools may monitor user-mode APIs or related call paths. Researchers examine direct and indirect syscalls to understand whether a particular technique avoids a particular interception point. That is a question about visibility at one layer, not proof of invisibility. The HITB presentation also notes that custom syscall instructions can be a static-analysis clue and that other components in a sample may still call hooked functions.
Interpreting behavior
A syscall or sequence of syscalls helps describe what a process asks Windows to do. That can support behavioral analysis even when a sample’s route to the kernel differs from a familiar API path. Microsoft describes malware behavior more broadly to include attempts to evade or disable security software, rather than defining detection around one function hook: Microsoft: Malware and other threats.
Rank #2
Keeping analysis tied to the Windows build
Syscall service numbers vary between Windows versions, as the HITB material explains. A number found in one build should not be treated as a timeless constant. Analysts need to record the operating-system build for the sample or lab context when interpreting such details. A RedOps index also lists coverage of direct and indirect syscalls, dynamic service-number retrieval, and hooked stubs, illustrating ongoing technical interest rather than proving a general detection or evasion success rate: RedOps articles.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat syscall-trace research can—and cannot—show
A 2018 study, NtMalDetect, evaluated native API syscall traces as a malware-classification method. Its authors reported a highest accuracy of 96% and recall of 95% for an evaluated approach that reduced traces to function names and represented them with n-gram and TF-IDF features. Those are results from that study’s dataset and method, not a benchmark for current endpoint products or malware detection generally: NtMalDetect study (2018).
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why avoiding a hook is not the same as avoiding detection
A direct or indirect syscall can affect a user-mode observation point, but the resulting behavior can leave evidence elsewhere. Relevant context may include unusual code, memory activity, process behavior, the origin of executed code, and later API calls. Microsoft’s overview of fileless threats describes multiple inspection layers, including AMSI, behavior monitoring, and memory scanning; it does not claim universal coverage for every syscall implementation: Microsoft: Fileless threats.
- Do not infer that a syscall is malicious from its instruction location alone.
- Do not infer that a process is undetectable because its syscall instruction is in
ntdll.dll. - Interpret visibility in light of the Windows build, security configuration, product, and the rest of the sample.
Whether a technique changes detection depends on those conditions; the cited material does not establish a universal success rate for direct or indirect syscalls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
