Kernel Karnage: Patching EDR in Kernel Space

SANS PenTest HackFest 2022

Speaker: Sander Forrer, Red Teamer, NVISO

Over time, EDR products have progressed from using techniques in user space to transitioning into kernel space by bringing a kernel component and leveraging kernel callbacks. These kernel callbacks allow EDRs to remain effective even when various bypass methods are used such as unhooking, direct syscalls and more.

This talk will show how these kernel callbacks can be located and manipulated in memory using a malicious kernel driver. We’ll showcase …

bypass edr edrs hackfest kernel memory nviso patching pentest products sans space syscalls techniques