kill anti-malware protected processes (BYOVD)

[Zodiac]

I found a nice github

Blackout​

• leveraging gmer driver to effectively disabling or killing EDRs and AVs.
• it bypass HVCI fluently
• the sample is sourced from loldrivers https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/

usage​

• Place the driver Blackout.sys in the same path as the executable
• The executable should be run in the context of an administrator
• Blackout.exe -p <process_id>
• for windows defender keep the program running to prevent the service from restarting it
  

URL : https://github.com/ZeroMemoryEx/Blackout

 

[ellisJdouglas]

almost there is no way to escape from scantime for gmer sys

 

[crypt0]

already posted bro yesterday thanks for your time though
interesting concept

 

[g4j]

nice