Awesome

syscall-detect

PoC capable of detecting manual syscalls from usermode.

More information available at: https://winternl.com/detecting-manual-syscalls-from-user-mode/