EN PT-BR
← Voltar ao feed
high

DefenderKiller POC abuses 2011-era Microsoft KSLDriver.sys for BYOVD EDR termination on Windows 11

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 17:04 · coletado há 3 dias

Flashpoint analysts detailed DefenderKiller, an open-source proof of concept that abuses KSLDriver.sys v1.1.0013.0, a legacy Microsoft malware-protection driver signed in 2011 that still loads on the latest Windows 11. Researcher Jehad Abudagga (redteamfortress) published the research on June 29, 2026 and later released the POC on GitHub. The driver's access control, which compares a requesting process image path against an AllowedProcessName registry value, can be subverted by pre-configuring the service and authorized path before driver start, enabling arbitrary process termination via ZwTerminateProcess(). Flashpoint identified 13 publicly available samples incorporating the technique, including obfuscated variants, though no confirmed intrusions are attributed. Exploitation requires administrative privileges to create the driver service, potentially obtained via local privilege escalation.

Detalhes técnicos

  • BYOVD abuse of a legitimately signed Microsoft driver still accepted by Windows driver verification.
  • Attacker sets the driver's service registry ImagePath and AllowedProcessName values, then loads the driver and sends IOCTL requests.
  • The driver resolves a supplied PID to a kernel process object and calls ZwTerminateProcess(), killing protected security processes.
  • Flashpoint assesses that LLMs may be lowering the barrier to user-mode and kernel-mode EDR killer development.

Remediação

  • Monitor for unexpected kernel driver installations and anomalous service creation.
  • Alert on modifications to registry values AllowedProcessName and ImagePath.
  • Correlate security process termination events occurring shortly after driver loads.
  • Enforce driver blocklisting / HVCI and restrict administrative privileges.

Linha do tempo

  1. flashpoint.io ↗ · pub. 29/10/2026 17:04 · coletado 29/10 19:00 primeiro registro

    DefenderKiller POC abuses 2011-era Microsoft KSLDriver.sys for BYOVD EDR termination on Windows 11

    ler a análise desta fonte

    Flashpoint analysts detailed DefenderKiller, an open-source proof of concept that abuses KSLDriver.sys v1.1.0013.0, a legacy Microsoft malware-protection driver signed in 2011 that still loads on the latest Windows 11. Researcher Jehad Abudagga (redteamfortress) published the research on June 29, 2026 and later released the POC on GitHub. The driver's access control, which compares a requesting process image path against an AllowedProcessName registry value, can be subverted by pre-configuring the service and authorized path before driver start, enabling arbitrary process termination via ZwTerminateProcess(). Flashpoint identified 13 publicly available samples incorporating the technique, including obfuscated variants, though no confirmed intrusions are attributed. Exploitation requires administrative privileges to create the driver service, potentially obtained via local privilege escalation.

    Technical Details

    • BYOVD abuse of a legitimately signed Microsoft driver still accepted by Windows driver verification.
    • Attacker sets the driver's service registry ImagePath and AllowedProcessName values, then loads the driver and sends IOCTL requests.
    • The driver resolves a supplied PID to a kernel process object and calls ZwTerminateProcess(), killing protected security processes.
    • Flashpoint assesses that LLMs may be lowering the barrier to user-mode and kernel-mode EDR killer development.

    Remediation

    • Monitor for unexpected kernel driver installations and anomalous service creation.
    • Alert on modifications to registry values AllowedProcessName and ImagePath.
    • Correlate security process termination events occurring shortly after driver loads.
    • Enforce driver blocklisting / HVCI and restrict administrative privileges.