Currently, in addition to merely focusing on avoiding scrutiny from EDRs (Endpoint Detection and Response) and Antivirus, the trend of using BYOVD (Bring Your Own Vulnerable Driver) techniques to disable the processes of EDRs and Antivirus by attackers is becoming increasingly popular.
The biggest drawback of the BYOVD technique is the need to find a way to install and execute drivers with vulnerabilities to exploit. Alternatively, a more straightforward approach is to exploit vulnerabilities in existing drivers on Windows
📌 Research
💻 Repo
#edr #windows
✈️ Whitehat Lab 💬Chat