Av Bypass

Filter-Mute Operation: Investigating EDR Internal Communication

28 July 2023 ~14 min By jeanpascal.thomas@orangecyberdefense.com
Edr Kernel Reversing Windows Av Bypass Reverse Engineering
For our annual internal hacker conference dubbed SenseCon in 2023, I decided to take a look at communication between a Windows driver and its user-mode process. Here are some details about that journey. Attackers could use Windows kernel R/W exploit primitive to avoid communication between EDR_Driver.sys and its EDR_process.exe. As a result some EDR detection mechanisms will be disabled and make it (partially) blind to malicious payloads. This blogpost describes…