Haidermustafa·May 28GoFly Killer: Abusing a Vulnerable Kernel Driver to Terminate Protected Processes from User ModeReverse engineering the GoFly driver to discover an unprotected IOCTL that allows any user-mode process to kill AV/EDR ,no exploits, no…
InDetect FYIbydfirloading·Dec 27, 2025Forensic Insights into an EDR Freeze AttackI have analyzed EDR-Freeze.exe, which puts EDR processes into a suspended “coma” state.
DuckWrites·Sep 2, 2025AV Enumeration with NetExecI was finishing a small lab to test Ligolo with NetExec when I found this really useful module: enum_av. The timing was perfect, since…
LogicTech·Jan 19, 2024Bypass Window Defender with free malware. (Virus;Trojan;Rat)My first suggestion.
