S12 - 0x12Dark Development·Oct 1Blinding EDR Drivers via IRP Dispatch Table OverwriteWelcome to this new Medium post, today we are going to explore IRP Dispatch Table Overwrite, a BYOVD technique that locates a driver object…
Jehad Abudagga·Jul 17Introducing CVE-2026–36425 | OPSWAT EDR TerminatorHello everyone, hope you all are doing well.
Jehad Abudagga·Jun 29Born to Defend, Weaponized to Kill: Weaponizing Microsoft’s Own Driver to Kill EDRsHello again everyone…
Nimesh nakum·Apr 19BYOVD Explained — How Attackers Use Signed Drivers to Kill EDRsYour EDR sees everything. Process launches, thread injections, DLL loads, filesystem writes. It has eyes inside the kernel — little hooks…
Azeezah·Apr 15Beyond Encryption: How Reynolds Ransomware Disables EDR Before ExecutionA response icon4A response icon4
Jehad Abudagga·Apr 5Reverse Engineering a 0day used Against EDRsHello again…A response icon4A response icon4
Mr_MalMan·Mar 28Arbitrary Process Termination via Vulnerable Driver: BYOVD Advanced Nim Edition with Full In-Memory…⚠️ Disclaimer: Everything in this post is for educational and authorized security research only. Only test on networks you own or have…
InDetect FYIbydfirloading·Dec 27, 2025Forensic Insights into an EDR Freeze AttackI have analyzed EDR-Freeze.exe, which puts EDR processes into a suspended “coma” state.
Pentest Team @greenhats.com·Dec 5, 2025When Delete Fails: Weaponizing ISOs to Defeat EDR RemediationIn the realm of advanced Windows exploitation and kernel interactions, the ‘Bring Your Own Vulnerable Driver’ (BYOVD) technique remains a…
