Backstab is a tool to Kill Antimalware Protected Processes.
Kill EDR Protected Processes
Have these local admin credentials but the EDR is standing in the way? Unhooking or direct syscalls are not working against the EDR? Well, why not just kill it? Backstab is a tool capable of killing antimalware protected processes by leveraging sysinternals’ Process Explorer (ProcExp) driver, which is signed by Microsoft.
What can it do?
Usage: backstab.exe <-n name || -p PID> [options]
-n, Choose process by name, including the .exe suffix
-p, Choose process by PID
-l, List handles of protected process
-k, Kill the protected process by closing its handles
-x, Close a specific handle
-d, Specify path to where ProcExp will be extracted
-s, Specify service name registry key
-u, Unload ProcExp driver
-a, adds SeDebugPrivilege
-h, Print this menu
Examples:
backstab.exe -n cyserver.exe -k [kill cyserver]
backstab.exe -n cyserver.exe -x E4C [Close handle E4C of cyserver]
backstab.exe -n cyserver.exe -l [list all handles of cyserver]
backstab.exe -p 4326 -k -d c:\driver.sys [kill protected process with PID 4326, extract ProcExp driver to C:\ drive]
How is that possible?
ProcExp has a signed kernel driver that it loads on startup, which allows it to kill handles that cannot be killed even as an administrator. When you use the UI, you cannot kill a protected process, but you can kill it handles because ProcExp UI instructs the kernel driver to kill those handles. Backstab does the same thing but without the UI element.
OpSec
Here is a quick rundown of what happens
What you should also know
JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…
The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…
Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…
SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…
Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…
Cybersecurity tools play a critical role in safeguarding digital assets, systems, and networks from malicious…