FortiEDR Protection

[Lilk]

Всем привет
Есть ли у кого актуальный метод дизейбла этого авера?
Fortinet EDR

 

[Knight]

У тебя есть права администратора?

 

[Lilk]

У тебя есть права администратора?

+

 

[Knight]

+

well you have couple ways, one is to kill it with a driver, most popular way. another way is to rename the driver at the start of boot of the pc (via schtasks, or another way) i don't know whether it will work or not. And if the EDR client has an "Uninstall Password" value in the Windows Registry, you can try to decrypt it and uninstall it from the Client itself, But recent versions of Forti agent probably don't have it, you can check and try