Инструмент для редиректа директории EDR в другое место
Протестировано:
▪️ Microsoft Windows Defender
▪️ Elastic Defend
▪️ Sophos Intercept X
EDR-Redir uses a Bind Filter (mini filter bindflt.sys) and the Windows Cloud Filter API (cldflt.sys) to redirect the Endpoint Detection and Response (EDR) 's working folder to a folder of the attacker's choice. Alternatively, it can make the folder appear corrupt to prevent the EDR's process services from functioning
🔗 Research
💻 Repo
#windows #edr #redteam
✈️ Whitehat Lab 💬 Chat