The principle, testing and Countermeasures of malicious software reverse closing EDR

Research causes

Recently, , I saw my brother who used to work together studying countermeasures EDR, The video is as follows ：

R3 Fight against soft , Take the soft road , Let kill soft have no way to go ~_ Bili, Bili _bilibili

Project introduction

principle

Load with Microsoft official signature sysinternals Process management drive (ProcExp) , Use its derived function to Kill EDR The effect of .

Refer to the Backstab project , The following behaviors are mainly carried out ：

1. Store the embedded drive on disk ;