Researchers Bypass Elastic EDR Call-Stack Signatures Using Call Gadgets

Security researchers have unveiled a technique that uses call gadgets to insert an arbitrary module into the call stack during module loading, successfully bypassing Elastic EDR’s signature-based detection rules. The researchers’ approach leverages controllable call instructions in system DLLs to alter the observed call stack at load time, disrupting the patterns Elastic monitors such as ntdll.dll|kernelbase.dll|Unbacked.

The proof-of-concept pulls a call-ret gadget from an older version of dsdmo.dll and, when triggered during loading of network libraries like wininet.dll, makes the inserted module appear in the stack and thus evade the alert. Elastic’s openness in sharing detection logic and payload testing tools has allowed the security community to understand and challenge its EDR mechanisms, according to Elastic EDR.

The work builds on prior research into shellcode obfuscation and callback-based API proxying, and, while only addressing a specific network module loading scenario, it underscores the ongoing evolution of evasion and detection strategies. Researchers disclosed the method to Elastic, which is actively updating its detection rules to address this evasion, as of 7 November 2025.