When the Hunter Becomes the Hunted: Using Minifilters to Disable EDRs

No ratings

Presented at Bsides London 2024 by

Tom Philippe

This presentation explores the advanced use of minifilters in offensive security operations, focusing on their application in bypassing and disabling EDRs. We will delve into the architecture of EDR systems and common offensive uses of mini filters, such as bypassing file system monitoring. We will then introduce a novel technique to entirely disable EDRs via the abuse of minifilters. The talk will also cover the implications for defensive security and potential countermeasures, aiming to provide valuable insights for both offensive and defensive security professionals.