Direct syscalls let malware bypass userland EDR hooks by calling the Windows kernel directly. Instead of going through the heavily hooked ntdll.dll stubs, the implant builds its own clean syscall stub (mov r10, rcx; mov eax, SSN; syscall; ret).