Direct vs Indirect Syscalls: Why the User-Kernel Boundary Matters in Security

Windows applications operate in user mode and must request kernel services through a defined interface, passing through Win32 APIs and ntdll.dll before reaching the kernel via a syscall. The distinction between direct and indirect syscalls has become a key topic in malware research, reverse engineering, and EDR analysis. Modern Endpoint Detection and Response tools monitor behavioral telemetry — such as memory allocation, thread creation, and process relationships — rather than relying solely on API names. This means that switching syscall methods does not automatically evade detection, as suspicious behavior can still be observed at other points in the execution chain. Understanding where Windows transitions from user mode to kernel mode is therefore more valuable to security researchers than simply asking how to bypass a specific security product.