EDR Evasion & Gap Matrix -- API Hook Coverage (exe capable)

API Name	DLL	Tier	Tactic	Description	MalCount	Score	CS	S1	MDE	CB	EL	XDR	TM
`amsiinit` *	amsi.dll	HIGH	AMSI Bypass	AMSI: initialize scan context	0	0	H	H	H	B	B	H	H
`amsiopenssession` *	amsi.dll	HIGH	AMSI Bypass	AMSI: open scanning session	0	0	H	H	H	B	B	H	H
`amsiscanstring` *	amsi.dll	HIGH	AMSI Bypass	AMSI: scan string for malware	0	0	H	H	H	B	B	H	H
`amsiscanbuffer` *	amsi.dll	HIGH	AMSI Bypass	AMSI: scan memory buffer (patched by many loaders)	0	0	H	H	H	B	B	H	H
`ntdebugactiveprocess` *	ntdll.dll	HIGH	Anti-Debug	Attach debugger to process	0	0	H	H	H	H	H	H	H
`ntqueueapcthread` *	ntdll.dll	HIGH	APC Injection	Queue APC to target thread (earlybird / APC injection)	0	0	H	H	H	H	H	H	H
`getprocaddress`	kernel32.dll	HIGH	API Resolution	Resolve export address from loaded module	2054	55	H	H	H	H	H	H	H
`ldrgetprocedureaddress`	ntdll.dll	HIGH	API Resolution	Resolve export address (loader-level GetProcAddress)	2	100	H	H	H	H	H	H	H
`send`	ws2_32.dll	MED	C2 Communications	Winsock: send data to remote	272	99	H	H	H	H	H	H	H
`recv`	ws2_32.dll	MED	C2 Communications	Winsock: receive data from remote	264	99	H	H	H	H	H	H	H
`connect`	ws2_32.dll	MED	C2 Communications	Winsock: TCP/UDP connect	262	99	H	H	H	H	H	H	H
`internetreadfile`	wininet.dll	MED	C2 Communications	Read HTTP response body (C2 payload download)	168	99	H	H	H	H	H	H	H
`winhttpsendrequest`	winhttp.dll	MED	C2 Communications	WinHTTP: send request	58	98	H	H	H	H	H	H	H
`winhttpconnect`	winhttp.dll	MED	C2 Communications	WinHTTP: connect to server	56	98	H	H	H	H	H	H	H
`winhttpopenrequest`	winhttp.dll	MED	C2 Communications	WinHTTP: open request handle	56	98	H	H	H	H	H	H	H
`httpopenrequestw`	wininet.dll	MED	C2 Communications	Open HTTP request handle (Unicode)	50	99	H	H	H	H	H	H	H
`internetconnectw`	wininet.dll	MED	C2 Communications	Open internet connection (Unicode)	50	99	H	H	H	H	H	H	H
`httpsendrequestw`	wininet.dll	MED	C2 Communications	Send HTTP request (Unicode)	46	99	H	H	H	H	H	H	H
`httpopenrequesta`	wininet.dll	MED	C2 Communications	Open HTTP request handle (ANSI)	30	100	H	H	H	H	H	H	H
`wsasend`	ws2_32.dll	MED	C2 Communications	Winsock: overlapped/async send	30	94	H	H	H	H	H	H	H
`internetconnecta`	wininet.dll	MED	C2 Communications	Open internet connection (ANSI)	30	100	H	H	H	H	H	H	H
`httpsendrequesta`	wininet.dll	MED	C2 Communications	Send HTTP request (ANSI)	28	100	H	H	H	H	H	H	H
`wsarecv`	ws2_32.dll	MED	C2 Communications	Winsock: overlapped/async recv	28	95	H	H	H	H	H	H	H
`wsaconnect`	ws2_32.dll	MED	C2 Communications	Winsock: connect to remote endpoint	2	99	H	H	H	H	H	H	H
`enumsystemlocales`	kernel32.dll	UNHOOKED-EXEC	Callback Abuse	Shellcode ptr passed as locale callback (score=100, 103 malicious samples)	135	98	B	B	-	-	-	-	B
`enumwindows`	user32.dll	UNHOOKED-EXEC	Callback Abuse	Window enumeration callback passes shellcode pointer	126	97	B	B	-	-	-	-	B
`enumchildwindows`	user32.dll	UNHOOKED-EXEC	Callback Abuse	Child-window enumeration callback abuse	126	98	B	B	-	-	-	-	B
`enumthreadwindows`	user32.dll	UNHOOKED-EXEC	Callback Abuse	Thread-window enumeration callback abuse	90	99	B	B	-	-	-	-	B
`certfindcertificateinstore`	crypt32.dll	UNHOOKED-EXEC	Callback Abuse	Certificate-store enumeration callback executes shellcode	48	95	B	B	-	-	-	-	B
`enumresourcelanguages`	kernel32.dll	UNHOOKED-EXEC	Callback Abuse	Resource-language enumeration callback abuse	27	100	B	B	-	-	-	-	B
`enumresourcenames`	kernel32.dll	UNHOOKED-EXEC	Callback Abuse	Resource-name enumeration callback abuse	20	100	B	B	-	-	-	-	B
`enumsystemlanguagegroups`	kernel32.dll	UNHOOKED-EXEC	Callback Abuse	Shellcode ptr passed as locale-enum callback (score=100, 16 malicious samples)	16	100	B	B	-	-	-	-	B
`enumresourcetypes`	kernel32.dll	UNHOOKED-EXEC	Callback Abuse	Resource-type enumeration callback abuse	8	100	B	B	-	-	-	-	B
`enumuilanguages`	kernel32.dll	UNHOOKED-EXEC	Callback Abuse	UI-language enumeration callback abuse	1	100	B	B	-	-	-	-	B
`imageenumeratecertificates` *	imagehlp.dll	UNHOOKED-EXEC	Callback Abuse	PE image certificate enumeration callback abuse	0	0	B	B	-	-	-	-	B
`enumdesktopwindows` *	user32.dll	UNHOOKED-EXEC	Callback Abuse	Desktop-window enumeration callback abuse	0	0	B	B	-	-	-	-	B
`cryptenumoidinfo` *	crypt32.dll	UNHOOKED-EXEC	Callback Abuse	Crypto OID enumeration callback abuse	0	0	B	B	-	-	-	-	B
`openclipboard`	user32.dll	LOW	Clipboard / Screenshot	Open clipboard for read/write (data theft)	204	94	H	B	B	B	B	B	B
`stretchblt`	gdi32.dll	LOW	Clipboard / Screenshot	Stretch/scale bitmap (screen capture)	144	97	H	B	B	B	B	B	B
`bitblt`	gdi32.dll	LOW	Clipboard / Screenshot	Bit-block transfer (GDI screen capture)	138	96	H	B	B	B	B	B	B
`getclipboarddata`	user32.dll	LOW	Clipboard / Screenshot	Read clipboard contents (credential theft)	72	98	H	B	B	B	B	B	B
`setclipboarddata`	user32.dll	LOW	Clipboard / Screenshot	Write to clipboard (clipboard hijack / crypto address swap)	71	95	H	B	B	B	B	B	B
`_cordllmain`	mscoree.dll	UNHOOKED-EXEC	COM / CLR Hosting	CLR DLL entry point	30	100	B	B	H	B	B	B	B
`clrcreateinstance`	mscoree.dll	UNHOOKED-EXEC	COM / CLR Hosting	Create CLR instance for in-process .NET hosting	2	100	B	B	H	B	B	B	B
`corexemain` *	mscoree.dll	UNHOOKED-EXEC	COM / CLR Hosting	CLR EXE entry point	0	0	B	B	H	B	B	B	B
`iclrmetahost` *	mscoree.dll	UNHOOKED-EXEC	COM / CLR Hosting	Host .NET CLR in native process (SharpPick, execute-assembly)	0	0	B	B	H	B	B	B	B
`idispatch_invoke` *	ole32.dll	UNHOOKED-EXEC	COM / CLR Hosting	IDispatch::Invoke -- execute via COM automation (VBScript, JScript engines)	0	0	B	B	H	B	B	B	B
`cocreateinstance`	ole32.dll	MED	COM Execution	Instantiate COM object (fileless execution via COM)	312	89	H	H	B	B	B	H	B
`coinitializeex`	ole32.dll	MED	COM Execution	Initialize COM apartment model	114	92	H	H	B	B	B	H	B
`credwritew` *	advapi32.dll	MED	Credential Access	Write credential to vault (Unicode)	0	0	H	H	H	H	H	H	H
`credreadw` *	advapi32.dll	MED	Credential Access	Read stored Windows credential (Unicode)	0	0	H	H	H	H	H	H	H
`credwritea` *	advapi32.dll	MED	Credential Access	Write credential to vault (ANSI)	0	0	H	H	H	H	H	H	H
`credreada` *	advapi32.dll	MED	Credential Access	Read stored Windows credential (ANSI)	0	0	H	H	H	H	H	H	H
`lsaopenpolicy`	advapi32.dll	MED	Credential Dumping	Open LSA policy (Mimikatz, Kerberoast)	36	99	H	H	H	H	H	H	H
`minidumpwritedump`	dbghelp.dll	MED	Credential Dumping	Write process minidump -- used for LSASS credential dump	18	99	H	H	H	H	H	H	H
`samopensamserver` *	samlib.dll	MED	Credential Dumping	Open SAM server for NTLM hash extraction	0	0	H	H	H	H	H	H	H
`samopenpassword` *	samlib.dll	MED	Credential Dumping	Open SAM password object	0	0	H	H	H	H	H	H	H
`logonusera`	advapi32.dll	MED	Credential Use	Log on user with supplied credentials (ANSI)	35	99	H	H	H	H	H	H	H
`logonuserw`	advapi32.dll	MED	Credential Use	Log on user with supplied credentials (Unicode)	35	99	H	H	H	H	H	H	H
`ntterminateprocess`	ntdll.dll	HIGH	Defense Evasion	Terminate process (kill AV/EDR)	26	100	H	H	H	H	H	H	H
`ntterminatethread` *	ntdll.dll	HIGH	Defense Evasion	Terminate thread	0	0	H	H	H	H	H	H	H
`createthread`	kernel32.dll	UNHOOKED-EXEC	Direct Thread	CreateThread local -- some EDRs only instrument CreateRemoteThread	862	71	H	H	H	H	H	H	H
`rtlcreatethread` *	ntdll.dll	UNHOOKED-EXEC	Direct Thread	Rtl helper for thread creation -- sometimes bypasses CreateRemoteThread hook	0	0	H	H	H	H	H	H	H
`loadlibrarya`	kernel32.dll	HIGH	DLL Injection	Load DLL by path name (ANSI)	604	78	H	H	H	H	H	H	H
`loadlibraryexw`	kernel32.dll	HIGH	DLL Injection	Load DLL with flags (Unicode)	519	70	H	H	H	H	H	H	H
`loadlibraryw`	kernel32.dll	HIGH	DLL Injection	Load DLL by path name (Unicode)	402	73	H	H	H	H	H	H	H
`loadlibraryexa`	kernel32.dll	HIGH	DLL Injection	Load DLL with flags (ANSI)	69	87	H	H	H	H	H	H	H
`ldrloaddll`	ntdll.dll	HIGH	DLL Injection	Loader-level DLL load (used in manual mapping)	2	100	H	H	H	H	H	H	H
`ntloaddll` *	ntdll.dll	HIGH	DLL Injection	Load DLL into process address space	0	0	H	H	H	H	H	H	H
`ldrunloaddll` *	ntdll.dll	HIGH	DLL Injection	Unload DLL via loader	0	0	H	H	H	H	H	H	H
`setdlldirectoryw`	kernel32.dll	UNHOOKED-EXEC	DLL Load Indirect	Override DLL search directory for sideloading	11	97	B	B	-	-	-	-	-
`loadpackagedlibrary` *	kernel32.dll	UNHOOKED-EXEC	DLL Load Indirect	Load DLL from app package (often unmonitored LoadLibrary path)	0	0	B	B	-	-	-	-	-
`adddlldirectory` *	kernel32.dll	UNHOOKED-EXEC	DLL Load Indirect	Add DLL search directory (DLL search order hijack)	0	0	B	B	-	-	-	-	-
`getaddrinfo`	ws2_32.dll	MED	DNS Resolution	Resolve hostname (C2 beacon target)	75	98	H	H	H	H	H	H	H
`getaddressinfo` *	ws2_32.dll	MED	DNS Resolution	Resolve hostname (modern getaddrinfo variant)	0	0	H	H	H	H	H	H	H
`switchtofiber`	kernel32.dll	UNHOOKED-EXEC	Fiber Execution	Switch execution to attacker fiber (no new thread, no hook)	30	98	B	B	-	-	B	-	-
`convertthreadtofiber`	kernel32.dll	UNHOOKED-EXEC	Fiber Execution	Convert calling thread to fiber (fiber exec setup)	22	99	B	B	-	-	B	-	-
`createfiber`	kernel32.dll	UNHOOKED-EXEC	Fiber Execution	Create fiber pointed at shellcode; executes in-thread without CreateThread hook	20	99	B	B	-	-	B	-	-
`writefile`	kernel32.dll	LOW	File Operations	Write to file/device (ransomware encrypt)	1664	66	H	H	B	H	H	B	H
`readfile`	kernel32.dll	LOW	File Operations	Read from file/device	1052	73	H	H	B	H	H	B	H
`createfilew`	kernel32.dll	LOW	File Operations	Create/open file handle (Unicode)	631	71	H	H	B	H	H	B	H
`createfilea`	kernel32.dll	LOW	File Operations	Create/open file handle (ANSI)	359	82	H	H	B	H	H	B	H
`deletefilew`	kernel32.dll	LOW	File Operations	Delete file (Unicode)	212	81	H	H	B	H	H	B	H
`deletefilea`	kernel32.dll	LOW	File Operations	Delete file (ANSI) -- ransomware shadow deletion	190	91	H	H	B	H	H	B	H
`copyfile`	kernel32.dll	LOW	File Operations	Copy file (exfil staging)	171	98	H	H	B	H	H	B	H
`setfileattributesw`	kernel32.dll	LOW	File Operations	Set file attributes (Unicode)	121	87	H	H	B	H	H	B	H
`setfileattributesa`	kernel32.dll	LOW	File Operations	Set file attributes (ANSI)	73	99	H	H	B	H	H	B	H
`movefilew`	kernel32.dll	LOW	File Operations	Move/rename file (Unicode)	73	91	H	H	B	H	H	B	H
`movefilea`	kernel32.dll	LOW	File Operations	Move/rename file (ANSI)	33	98	H	H	B	H	H	B	H
`copyfileex`	kernel32.dll	LOW	File Operations	Copy file with progress callback	32	100	H	H	B	H	H	B	H
`ntcreatefile`	ntdll.dll	LOW	File Operations	NT: create/open file object (syscall path)	8	99	H	H	B	H	H	B	H
`ntwritefile`	ntdll.dll	LOW	File Operations	NT: write file via syscall	6	99	H	H	B	H	H	B	H
`ntreadfile`	ntdll.dll	LOW	File Operations	NT: read file via syscall	4	99	H	H	B	H	H	B	H
`ntdeletefile` *	ntdll.dll	LOW	File Operations	NT: delete file via syscall	0	0	H	H	B	H	H	B	H
`mapviewoffile`	kernel32.dll	UNHOOKED-EXEC	File-Backed Mapping	Map section into process -- executable pages without VirtualAlloc	248	86	H	H	-	H	H	H	H
`createfilemapping`	kernel32.dll	UNHOOKED-EXEC	File-Backed Mapping	Create file-backed section object (module stomping)	152	94	H	H	-	H	H	H	H
`mapviewoffileex`	kernel32.dll	UNHOOKED-EXEC	File-Backed Mapping	Map section at specified base address	2	97	H	H	-	H	H	H	H
`heapalloc`	kernel32.dll	UNHOOKED-EXEC	Heap Staging	Allocate from heap (not VirtualAlloc -- often unhooked)	1420	77	-	-	-	-	-	-	-
`heapcreate`	kernel32.dll	UNHOOKED-EXEC	Heap Staging	Create private heap for shellcode staging (avoids VirtualAlloc hook)	476	90	-	-	-	-	-	-	-
`localalloc`	kernel32.dll	UNHOOKED-EXEC	Heap Staging	Local heap allocation for shellcode staging	446	89	-	-	-	-	-	-	-
`globalalloc`	kernel32.dll	UNHOOKED-EXEC	Heap Staging	Global heap allocation for shellcode staging	354	91	-	-	-	-	-	-	-
`unhookwindowshookex`	user32.dll	MED	Keylogging	Remove installed hook	82	97	H	H	H	B	B	H	H
`setwindowshookexw`	user32.dll	MED	Keylogging	Install keyboard/mouse hook for credential capture (Unicode)	25	98	H	H	H	B	B	H	H
`setwindowshookexa`	user32.dll	MED	Keylogging	Install keyboard/mouse hook for credential capture (ANSI)	17	99	H	H	H	B	B	H	H
`readprocessmemory`	kernel32.dll	HIGH	Memory Access	Read from remote process memory	162	95	H	H	H	H	H	H	H
`ntreadvirtualmemory`	ntdll.dll	HIGH	Memory Access	Read virtual memory from target process	2	100	H	H	H	H	H	H	H
`virtualqueryex`	kernel32.dll	MED	Memory Enumeration	Query virtual memory in remote process	72	96	H	H	H	H	H	H	H
`ntqueryvirtualmemory` *	ntdll.dll	MED	Memory Enumeration	Query virtual memory regions (EDR detection avoidance)	0	0	H	H	H	H	H	H	H
`virtualalloc`	kernel32.dll	HIGH	Memory Injection	Allocate virtual memory (kernel32 thunk over NtAllocate)	1006	80	H	H	H	H	H	H	H
`virtualprotect`	kernel32.dll	HIGH	Memory Injection	Change memory page protection	648	84	H	H	H	H	H	H	H
`writeprocessmemory`	kernel32.dll	HIGH	Memory Injection	Write to remote process memory	224	97	H	H	H	H	H	H	H
`virtualallocex`	kernel32.dll	HIGH	Memory Injection	Allocate in remote process address space	202	95	H	H	H	H	H	H	H
`virtualprotectex`	kernel32.dll	HIGH	Memory Injection	Change page protection in remote process	50	97	H	H	H	H	H	H	H
`ntallocatevirtualmemory`	ntdll.dll	HIGH	Memory Injection	Allocate virtual memory in target process	4	100	H	H	H	H	H	H	H
`ntwritevirtualmemory`	ntdll.dll	HIGH	Memory Injection	Write to virtual memory of target process	2	100	H	H	H	H	H	H	H
`ntallocatevirtualmemoryex` *	ntdll.dll	HIGH	Memory Injection	Extended VirtualAlloc via NtAllocateVirtualMemoryEx (Win10 1803+)	0	0	H	H	H	H	H	H	H
`ntprotectvirtualmemory` *	ntdll.dll	HIGH	Memory Injection	Change page protection (set RWX for shellcode)	0	0	H	H	H	H	H	H	H
`rtlzeromemory` *	ntdll.dll	UNHOOKED-EXEC	Memory Primitives	Zero memory (wipe payload evidence)	0	0	-	-	-	-	-	-	-
`rtlfilltilememory` *	ntdll.dll	UNHOOKED-EXEC	Memory Primitives	Fill memory tiles (evasive copy pattern)	0	0	-	-	-	-	-	-	-
`rtlmovememory` *	ntdll.dll	UNHOOKED-EXEC	Memory Primitives	Copy shellcode bytes -- bypasses WriteProcessMemory hook	0	0	-	-	-	-	-	-	-
`rtlcopymemory` *	ntdll.dll	UNHOOKED-EXEC	Memory Primitives	memcpy alias used to stage shellcode	0	0	-	-	-	-	-	-	-
`connectnamedpipe`	kernel32.dll	LOW	Named Pipe / IPC	Wait for named pipe client connection	60	90	H	H	B	B	H	B	B
`createnamedpipea`	kernel32.dll	LOW	Named Pipe / IPC	Create named pipe (ANSI) -- lateral movement / token theft	24	96	H	H	B	B	H	B	B
`createnamedpipew`	kernel32.dll	LOW	Named Pipe / IPC	Create named pipe (Unicode)	17	91	H	H	B	B	H	B	B
`ntcreatemailslotfile` *	ntdll.dll	LOW	Named Pipe / IPC	NT: create mailslot (IPC)	0	0	H	H	B	B	H	B	B
`ntcreatenamedpipefile` *	ntdll.dll	LOW	Named Pipe / IPC	NT: create named pipe via syscall	0	0	H	H	B	B	H	B	B
`adjusttokenprivileges`	advapi32.dll	MED	Privilege Escalation	Enable/disable token privileges (SeDebugPrivilege)	284	92	H	H	H	H	H	H	H
`createtoken` *	ntdll.dll	MED	Privilege Escalation	Create a new access token	0	0	H	H	H	H	H	H	H
`ntadjustprivilegestoken` *	ntdll.dll	MED	Privilege Escalation	NT: adjust token privileges directly	0	0	H	H	H	H	H	H	H
`openprocess`	kernel32.dll	HIGH	Process Access	Open handle to target process	400	85	H	H	H	H	H	H	H
`ntopenprocess` *	ntdll.dll	HIGH	Process Access	Open handle to target process	0	0	H	H	H	H	H	H	H
`ntcreateuserprocess` *	ntdll.dll	MED	Process Creation	NT: create user process (modern Vista+ path)	0	0	H	H	H	H	H	H	H
`ntcreateprocess` *	ntdll.dll	MED	Process Creation	NT: create process (legacy syscall)	0	0	H	H	H	H	H	H	H
`ntcreateprocessex` *	ntdll.dll	MED	Process Creation	NT: create process (extended, pre-Vista path)	0	0	H	H	H	H	H	H	H
`createprocessw`	kernel32.dll	HIGH	Process Creation	Create new process (Unicode)	182	81	H	H	H	H	H	H	H
`createprocessa`	kernel32.dll	HIGH	Process Creation	Create new process (ANSI)	163	94	H	H	H	H	H	H	H
`createprocesswithlogonw`	advapi32.dll	HIGH	Process Creation	Spawn process with alternate credentials	55	100	H	H	H	H	H	H	H
`createprocessasuserw`	advapi32.dll	HIGH	Process Creation	Spawn process as different user	52	96	H	H	H	H	H	H	H
`createprocesswithtoken`	advapi32.dll	HIGH	Process Creation	Spawn process with stolen token	6	100	H	H	H	H	H	H	H
`createtoolhelp32snapshot`	kernel32.dll	LOW	Process Enumeration	Snapshot process/thread/module list (initial recon)	266	93	H	H	B	B	H	B	B
`process32next`	kernel32.dll	LOW	Process Enumeration	Iterate process snapshot	149	98	H	H	B	B	H	B	B
`process32first`	kernel32.dll	LOW	Process Enumeration	First entry from process snapshot	144	98	H	H	B	B	H	B	B
`module32first`	kernel32.dll	LOW	Process Enumeration	First loaded module entry (find ntdll base for syscalls)	35	99	H	H	B	B	H	B	B
`ntqueryinformationprocess`	ntdll.dll	LOW	Process Enumeration	Query per-process info (read PEB, check debugger)	34	98	H	H	B	B	H	B	B
`ntquerysysteminformation`	ntdll.dll	LOW	Process Enumeration	Query system-wide info (running process list for EDR scanning)	28	99	H	H	B	B	H	B	B
`module32next`	kernel32.dll	LOW	Process Enumeration	Iterate loaded modules	21	99	H	H	B	B	H	B	B
`thread32next`	kernel32.dll	LOW	Process Enumeration	Iterate thread snapshot	14	99	H	H	B	B	H	B	B
`thread32first`	kernel32.dll	LOW	Process Enumeration	First entry from thread snapshot	12	99	H	H	B	B	H	B	B
`ntqueryinformationthread`	ntdll.dll	LOW	Process Enumeration	Query per-thread info	2	99	H	H	B	B	H	B	B
`ntunmapviewofsection`	ntdll.dll	HIGH	Process Hollowing	Unmap section from process (hollowing setup)	4	100	H	H	H	H	H	H	H
`rtlcreateprocessparametersex` *	ntdll.dll	HIGH	Process Hollowing	Build process parameters block (hollowing / ghosting)	0	0	H	H	H	H	H	H	H
`regsetvalueexa`	advapi32.dll	MED	Registry Persistence	Set registry value (ANSI)	119	96	H	H	H	H	H	H	H
`regsetvalueexw`	advapi32.dll	MED	Registry Persistence	Set registry value (Unicode)	109	91	H	H	H	H	H	H	H
`regcreatekeyexw`	advapi32.dll	MED	Registry Persistence	Create registry key extended (Unicode)	84	91	H	H	H	H	H	H	H
`regcreatekeyexa`	advapi32.dll	MED	Registry Persistence	Create registry key extended (ANSI)	82	97	H	H	H	H	H	H	H
`regdeletevaluew`	advapi32.dll	MED	Registry Persistence	Delete registry value (Unicode)	75	93	H	H	H	H	H	H	H
`regdeletevaluea`	advapi32.dll	MED	Registry Persistence	Delete registry value (ANSI)	65	98	H	H	H	H	H	H	H
`regcreatekeyw`	advapi32.dll	MED	Registry Persistence	Create registry key (Unicode)	17	99	H	H	H	H	H	H	H
`regcreatekeya`	advapi32.dll	MED	Registry Persistence	Create registry key (ANSI)	9	99	H	H	H	H	H	H	H
`ntcreatesection`	ntdll.dll	HIGH	Section Injection	Create shared memory section object	6	100	H	H	H	H	H	H	H
`ntmapviewofsection`	ntdll.dll	HIGH	Section Injection	Map shared section into target process	6	100	H	H	H	H	H	H	H
`ntmapviewofsectionex` *	ntdll.dll	HIGH	Section Injection	Extended section mapping (Win10 1803+)	0	0	H	H	H	H	H	H	H
`openservicew`	advapi32.dll	MED	Service Persistence	Open handle to existing service (Unicode)	39	96	H	H	H	B	H	H	H
`createservicew`	advapi32.dll	MED	Service Persistence	Create new Windows service for persistence (Unicode)	34	97	H	H	H	B	H	H	H
`openservicea`	advapi32.dll	MED	Service Persistence	Open handle to existing service (ANSI)	21	98	H	H	H	B	H	H	H
`createservicea`	advapi32.dll	MED	Service Persistence	Create new Windows service for persistence (ANSI)	15	99	H	H	H	B	H	H	H
`changeserviceconfiga`	advapi32.dll	MED	Service Persistence	Modify service binary path (ANSI)	13	98	H	H	H	B	H	H	H
`changeserviceconfigw`	advapi32.dll	MED	Service Persistence	Modify service binary path (Unicode)	13	98	H	H	H	B	H	H	H
`ntopenthread` *	ntdll.dll	HIGH	Thread Access	Open handle to target thread	0	0	H	H	H	H	H	H	H
`getthreadcontext`	kernel32.dll	MED	Thread Hijacking	Get thread registers (hollowing / hijacking setup)	244	87	H	H	H	H	H	H	H
`setthreadcontext`	kernel32.dll	MED	Thread Hijacking	Set thread context -- redirect instruction pointer	228	93	H	H	H	H	H	H	H
`ntsetcontextthread`	ntdll.dll	HIGH	Thread Hijacking	Set thread context (redirect RIP/EIP to shellcode)	2	100	H	H	H	H	H	H	H
`ntresumethread`	ntdll.dll	HIGH	Thread Hijacking	Resume thread after injection	2	100	H	H	H	H	H	H	H
`ntsuspendthread` *	ntdll.dll	HIGH	Thread Hijacking	Suspend thread for injection or hijack	0	0	H	H	H	H	H	H	H
`createremotethread`	kernel32.dll	HIGH	Thread Injection	Create execution thread in remote process	92	95	H	H	H	H	H	H	H
`rtlcreateuserthread`	ntdll.dll	HIGH	Thread Injection	Create remote thread via Rtl helper	24	100	H	H	H	H	H	H	H
`createremotethreadex`	kernel32.dll	HIGH	Thread Injection	Create remote thread with extended attributes	2	100	H	H	H	H	H	H	H
`ntcreatethreadex` *	ntdll.dll	HIGH	Thread Injection	Create thread in target process (primary syscall)	0	0	H	H	H	H	H	H	H
`ntcreatethread` *	ntdll.dll	HIGH	Thread Injection	Create thread (legacy pre-Vista syscall)	0	0	H	H	H	H	H	H	H
`createthreadpoolwork`	kernel32.dll	UNHOOKED-EXEC	Thread Pool	Create thread pool work item with shellcode callback	26	99	H	B	-	-	B	B	B
`submitthreadpoolwork`	kernel32.dll	UNHOOKED-EXEC	Thread Pool	Submit pool work item (trigger shellcode execution)	26	99	H	B	-	-	B	B	B
`queueuserworkitem`	kernel32.dll	UNHOOKED-EXEC	Thread Pool	Queue shellcode callback to thread pool -- avoids CreateRemoteThread	10	99	H	B	-	-	B	B	B
`createthreadpoolwait`	kernel32.dll	UNHOOKED-EXEC	Thread Pool	Pool wait object with shellcode callback on signal	2	100	H	B	-	-	B	B	B
`setthreadpoolwait`	kernel32.dll	UNHOOKED-EXEC	Thread Pool	Arm pool wait object (triggers shellcode)	2	100	H	B	-	-	B	B	B
`setthreadpooltimer` *	kernel32.dll	UNHOOKED-EXEC	Thread Pool	Arm pool timer to trigger shellcode callback	0	0	H	B	-	-	B	B	B
`createthreadpooltimer` *	kernel32.dll	UNHOOKED-EXEC	Thread Pool	Pool timer with shellcode callback; fires on schedule	0	0	H	B	-	-	B	B	B
`settimer`	user32.dll	UNHOOKED-EXEC	Timer Callbacks	Win32 timer with WndProc callback (runs in message loop, no new thread)	206	92	B	B	-	-	-	-	-
`setwaitabletimer`	kernel32.dll	UNHOOKED-EXEC	Timer Callbacks	Set waitable timer with APC callback pointing at shellcode	172	91	B	B	-	-	-	-	-
`createtimerqueuetimer`	kernel32.dll	UNHOOKED-EXEC	Timer Callbacks	Timer queue callback executes shellcode when fired	50	99	B	B	-	-	-	-	-
`createwaitabletimer`	kernel32.dll	UNHOOKED-EXEC	Timer Callbacks	Kernel waitable timer object	19	99	B	B	-	-	-	-	-
`rtlregisterwait` *	ntdll.dll	UNHOOKED-EXEC	Timer Callbacks	NT wait registration with callback (no CreateThread)	0	0	B	B	-	-	-	-	-
`duplicatetokenex`	advapi32.dll	MED	Token Impersonation	Duplicate token with new impersonation level	118	98	H	H	H	H	H	H	H
`impersonateloggedonuser`	advapi32.dll	MED	Token Impersonation	Impersonate a logged-on user token	38	98	H	H	H	H	H	H	H
`dispatchmessage`	user32.dll	UNHOOKED-EXEC	Window Proc / Message	Dispatch message to window procedure	193	96	B	-	-	-	-	-	-
`sendmessage`	user32.dll	UNHOOKED-EXEC	Window Proc / Message	Synchronous message dispatch through WndProc	171	97	B	-	-	-	-	-	-
`postmessage`	user32.dll	UNHOOKED-EXEC	Window Proc / Message	Async message dispatch through WndProc	129	98	B	-	-	-	-	-	-
`callwindowproc`	user32.dll	UNHOOKED-EXEC	Window Proc / Message	Execute via window procedure pointer -- shellcode masquerades as WndProc	125	98	B	-	-	-	-	-	-
`iwbemservices_execquery` *	wbemdisp.dll	UNHOOKED-EXEC	WMI / DCOM	IWbemServices::ExecQuery -- fileless WMI-based lateral movement / exec	0	0	H	H	H	B	B	H	H

EDR Evasion & Gap Matrix — API Hook Coverage (exe capable)