Skip to content

C# AV/EDR Killer using less-known driver (BYOVD)

Notifications You must be signed in to change notification settings

Codekies/Darkside

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Darkside

image

This is a C# AV/EDR Killer using Rogue Anti-Malware Driver 3.3. This driver is not present in the loldrivers or Windows blocklist at the time of this writing. The only reason I'm making this public is because the company has already published a fix in version 3.4, and Microsoft will likely block this driver soon. This driver can be used in Windows 23H2 with HVCI enabled, loldrivers blocklist, or WDAC enabled. HVCI is designed to ensure the integrity of code executed in the kernel, but it cannot protect against all possible vulnerabilities or actions that can be performed through drivers or system interfaces.

Steps

  1. Load and start the driver:
sc create TrueSight binPath="c:\path\to\truesight.sys" type= kernel start= demand
sc start TrueSight
  1. Start Darkside
Darkside.exe -p PID

Recommendations

  1. Block this driver through WDAC or wait till Microsoft do it (at your own risk)
  2. Limit local privileges, audit and prevent privesc attacks.

About

C# AV/EDR Killer using less-known driver (BYOVD)

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C# 100.0%