Windows/x64 NtCreateThreadEx - Stealthy Thread Injection (EDR Bypass)

<div class="space-y-8 text-slate-800 font-sans leading-relaxed">

  <div class="border-l-4 border-red-500 pl-5 py-3 bg-red-50/60 rounded-r-xl">
    <p class="text-xs font-bold uppercase tracking-widest text-red-700 mb-1">Modern Evasion - Windows x64 - NtCreateThreadEx</p>
    <h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Windows/x64 NtCreateThreadEx - CreateRemoteThread'e Gelismis Alternatif</h2>
    <p class="text-sm text-slate-600 mt-2">CreateRemoteThread yuksek profilli Win32 API olup cog EDR hooklayarak tespit eder. NtCreateThreadEx undocumented NTAPI fonksiyonudur ve bazi hook mekanizmalarini atlatir.</p>
  </div>

  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">NtCreateThreadEx Prototype</h3>
    <div class="bg-slate-900 text-cyan-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
typedef NTSTATUS (NTAPI *pNtCreateThreadEx)(
    OUT PHANDLE ThreadHandle,
    IN  ACCESS_MASK DesiredAccess,
    IN  LPVOID ObjectAttributes,
    IN  HANDLE ProcessHandle,
    IN  LPVOID StartAddress,
    IN  LPVOID Parameter,
    IN  ULONG Flags,
    IN  SIZE_T StackZeroBits,
    IN  SIZE_T SizeOfStackCommit,
    IN  SIZE_T SizeOfStackReserve,
    OUT LPVOID BytesBuffer
);
// Kullanim:
HMODULE ntdll = GetModuleHandleA("ntdll.dll");
pNtCreateThreadEx NtCTE = (pNtCreateThreadEx)
    GetProcAddress(ntdll, "NtCreateThreadEx");
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">Direkt Syscall Yontemi</h3>
    <div class="bg-slate-900 text-slate-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
EDR'ler genellikle ntdll.dll fonksiyonlarini hooklar.
Syscall numarasini ntdll PE'sinden okuyup manuel
syscall ile bu hooklar devre disi kalir.

Araclar:
- Hell's Gate (jthuraisamy)
- Halo's Gate (byt3bl33d3r)
- SysWhispers2/3
- RecycledGate
    </div>
  </div>
</div>