Description
Modern EDR products monitor system activity not from userland but from the kernel itself, registering callbacks and filter drivers that fire on every process creation, file operation, and network connection. This module teaches how to locate and silence those monitoring channels at their source using a BYOVD kernel read/write primitive. Students work through four independent telemetry channels: overwriting process creation notify routine pointers to blind EDRs to process activity; unlinking MiniFilter callback nodes from the Filter Manager’s per-volume operation lists to remove file telemetry without touching any function pointer; patching WFP callout entries to silence network monitoring; and zeroing the ETW Threat Intelligence provider’s enable flag to disable kernel-level injection detection. Each technique is implemented in C++ with full working code, WinDbg offset resolution, detection analysis, and YARA rules
There are no reviews yet.