Krueger : Exploiting Windows Defender To Neutralize EDR Systems

Krueger is a Proof of Concept (PoC) .NET post-exploitation tool designed to disable Endpoint Detection and Response (EDR) systems during lateral movement in a network.

Developed by security researcher Logan Goins, Krueger leverages Windows Defender Application Control (WDAC), a Microsoft utility originally intended to enhance security by controlling executable code on Windows devices.

However, Krueger weaponizes this feature to block EDR functionality at both user and kernel levels, enabling attackers to operate undetected.

Functionality

Krueger operates by deploying a custom WDAC policy to the target system.

This policy is written to the C:\Windows\System32\CodeIntegrity\ directory and becomes active upon a system reboot. The policy effectively prevents EDR sensors from starting during boot, rendering them inoperative.

Attackers with administrative privileges can use this technique on individual machines or scale it across entire networks by leveraging domain admin access and distributing malicious policies via Group Policy Objects (GPOs).

One of Krueger’s key features is its ability to run entirely from memory using tools like execute-assembly or inlineExecute-Assembly.

For scenarios where writing policies to disk is not feasible, Krueger includes an embedded WDAC policy within its .NET assembly, which can be read from memory and deployed dynamically at runtime.

Detecting Krueger-based attacks is particularly challenging due to the legitimate nature of WDAC policies and the speed of execution.

Once the malicious policy is applied and the system reboots, EDR systems are disabled without triggering obvious alarms. This stealthy approach allows attackers to bypass traditional security defenses effectively.

To counteract such attacks, organizations are advised to:

• Enforce robust WDAC policies via GPOs that override local changes.
• Restrict administrative privileges and access to sensitive directories like CodeIntegrity.
• Regularly audit and verify WDAC policies for unauthorized modifications.
• Adhere to the principle of least privilege for network administration.

Krueger exemplifies how security tools like WDAC can be repurposed offensively, highlighting the ongoing arms race between attackers and defenders in cybersecurity.

While it serves as a valuable research tool for identifying vulnerabilities, its misuse underscores the need for proactive defense measures.