EchoDaemon retweeted
This is pretty embarrassing 🙈
Microsoft has a signed Defender driver that can be abused to kill Defender/EDR and modify protected files and registry settings
We also can’t really solve this the usual way by adding the driver to the vulnerable driver blocklist. It’s Microsoft’s own Defender component!!
MSRC says it doesn’t require immediate servicing because you already need admin privileges 😏
Which probably means this MS-signed EDR killer will stay usable for a while. Nice 🫶
Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations.
An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed.
research.checkpoint.com/2026…
EchoDaemon retweeted
beignet - Donut for MacOS, converts darwin/arm64 and darwin/amd64 .dylib files into MacOS PIC shellcode, can be used as a CLI or imported as a Golang library github.com/sliverarmory/beig…
EchoDaemon retweeted
🔀 Reversing for dummies - x86 assembly and C code (Beginner/ADHD friendly)
Blog: 0x44.cc/reversing/2021/07/21…
Author: Sami ALAOUI KENDIL
#infosec
EchoDaemon retweeted
HallWatch - User-mode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more github.com/Zypherion-Technol…
EchoDaemon retweeted
Decode 5.8 GHz FPV with any SDR that reaches the band.
HackRF / BladeRF / ANTSDR / USRP / Pluto. Decoding runs in GNU Radio. Linux, macOS, Windows.
64 channels · NTSC + PAL · live spectrum · one-command setup
fpv-sdr: github.com/lukeswitz/fpv-sdr
EchoDaemon retweeted
Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why.
r136a1.dev/2026/05/07/where-…
EchoDaemon retweeted
Windows Analysis and Research Toolkit github.com/mrT4ntr4/NtWarden
EchoDaemon retweeted
HashDump-BypassEDR：github.com/AabyssZG/HashDump…
通过系统白程序 Reg.exe 的拓展应用，巧妙绕过EDR的拦截点，实现绕过EDR从而DumpHash😈
该方法针对Windows系列均有效，操作难度不大，具有实战价值🥳
本项目实战文章：blog.zgsec.cn/archives/EDR-D…
源代码和Release已发布，师傅们麻烦点个Star，万分感谢！😍
EchoDaemon retweeted
My curated awesome list of cybersecurity research, RE material, exploitation write-ups, and tools.
github.com/0xor0ne/awesome-l…
#infosec
EchoDaemon retweeted
The US government declassifying a PoC:
#include<▇▇▇▇.h>
int ▇▇▇_▇▇▇▇ {
▇▇▇▇▇▇▇
▇▇▇▇▇▇
▇▇▇▇▇ ▇▇▇
return ▇▇;
}
/*
* ▇▇▇▇▇ ▇▇▇
* ▇▇▇▇▇▇▇ ▇
*/
EchoDaemon retweeted
Get your phrack signed at the @nostarch booth at @defcon Sat at 4p! We'll have @bsdaemon, @chompie1337, @netspooky, @ackmage, and @richinseattle for this rare event! #phrack72 #phrackat40
EchoDaemon retweeted
Hide your WiFi, hide your BT, hide your LTE… but good luck with that. WarDragon sees all. 🐉👀
