Skip to content

EDRStartupHinder: A red team tool to prevent Antivirus and EDR from running.

Notifications You must be signed in to change notification settings

TwoSevenOneT/EDRStartupHinder

Repository files navigation

EDRStartupHinder

EDRStartupHinder prevents Antivirus and EDR from running by redirecting a core DLL in the System32 folder to another location during Windows startup.

Command Line Syntax

EDRStartupHinder.exe <FakeLib> <OriginalLib> <EDRProcess> <ServiceName> <ServiceGroup>

EDRStartupHinder.exe <VirtualPath>

To remove a link that was previously created

Links

EDRStartupHinder: EDR Startup Process Blocker

Demo Video

Youtube EDR-Redir V2: https://youtu.be/mSywzuGsirU

Author:

Two Seven One Three

Tools For Security Researcher and Hacker

Essential hardware tools that every security researcher and hacker should have in their toolkit:

Essential Tools For Security Researcher and Hacker

READING

Some books you should read to sharpen your cybersecurity skills, especially in offensive security:

Books on Programming and Cybersecurity recommended by Zero Salarium Researchers

About

EDRStartupHinder: A red team tool to prevent Antivirus and EDR from running.

Resources

Stars

Watchers

Forks

Packages

No packages published