When the Hunter Becomes the Hunted: Using Minifilters to Disable EDRs

Attackers are perpetually seeking new ways to bypass defensive mechanisms. I myself love doing a bit of research to try and find new ways to evade security products. Inspired by the concepts from the article When the Hunter Becomes the Hunted: Using Custom Callbacks to Disable EDRs by Altered Security, I present a new technique involving signed minifilters to disable EDR systems.

Introducing Minifilters

Minifilters are specialized kernel-mode drivers that can be used to filter I/O operations by registering to …

cybersecurity edr evasion hacking malware