Backstab is a tool to Kill Antimalware Protected Processes.
Kill EDR Protected Processes
Have these local admin credentials but the EDR is standing in the way? Unhooking or direct syscalls are not working against the EDR? Well, why not just kill it? Backstab is a tool capable of killing antimalware protected processes by leveraging sysinternals’ Process Explorer (ProcExp) driver, which is signed by Microsoft.
What can it do?
Usage: backstab.exe <-n name || -p PID> [options]
-n, Choose process by name, including the .exe suffix
-p, Choose process by PID
-l, List handles of protected process
-k, Kill the protected process by closing its handles
-x, Close a specific handle
-d, Specify path to where ProcExp will be extracted
-s, Specify service name registry key
-u, Unload ProcExp driver
-a, adds SeDebugPrivilege
-h, Print this menu
Examples:
backstab.exe -n cyserver.exe -k [kill cyserver]
backstab.exe -n cyserver.exe -x E4C [Close handle E4C of cyserver]
backstab.exe -n cyserver.exe -l [list all handles of cyserver]
backstab.exe -p 4326 -k -d c:\driver.sys [kill protected process with PID 4326, extract ProcExp driver to C:\ drive]
How is that possible?
ProcExp has a signed kernel driver that it loads on startup, which allows it to kill handles that cannot be killed even as an administrator. When you use the UI, you cannot kill a protected process, but you can kill it handles because ProcExp UI instructs the kernel driver to kill those handles. Backstab does the same thing but without the UI element.
OpSec
Here is a quick rundown of what happens
What you should also know
bevigil-cli provides a unified command line interface and python library for using BeVigil OSINT API. BeVigil…
Explore the comprehensive world of Open-Source Intelligence (OSINT) with our curated list of active links…
BBOT (Bighuge BLS OSINT Tool) is a recursive internet scanner inspired by Spiderfoot, but designed to…
Andriller - is software utility with a collection of forensic tools for smartphones. It performs…
Designed as a full-stack web application, this tool amalgamates a plethora of services to streamline…
Tools and packages that are used for countering forensic activities, including encryption, steganography, and anything…