DefenderKiller — Weaponizing Microsoft's Own Driver to Kill EDRs

DefenderKiller — Weaponizing Microsoft's Own Driver to Kill EDRs

The tool exploitats a vulnerability in the original signed Microsoft Malware Protection driver (KSLDriver.sys). Unlike BYOVD tools, it does not require delivering a vulnerable driver — the driver is already present on the system.

Workflow: Launching the KSLDriver.sys driver as a custom service → Bypassing the AllowedProcessName check via the registry → Sending IOCTL 0x222044 (sub-command 8) with the target PID → The driver calls ZwTerminateProcess in kernel mode (Ring 0) → The target process is terminated

Advantages: • Bypasses Protected Process Light and ObRegisterCallbacks • Not listed in the Microsoft Vulnerable Driver Blocklist and remains undetected (0/70 on VirusTotal) • Passes driver signature verification on all Windows versions from 7 to 11, including systems with the April 2026 driver trust policy enabled

Limitation: It only demonstrates process termination capabilities — no extended arbitrary read/write operations.

Article: https://medium.com/@jehadbudagga/born-to-defend-weaponized-to-kill-weaponizing-microsofts-own-driver-to-kill-edrs-af4b85c1a43c

Tool: https://github.com/redteamfortress/DefenderKiller