Week of September 16, 2024

Kill-Floor is a publicly released proof-of-concept tool that leverages a vulnerable Avast Anti-Rootkit driver (aswarpot.bin) via the Bring Your Own Vulnerable Driver (BYOVD) technique to terminate security product processes. It loads the driver, then continuously scans for and kills processes associated with known AV/EDR vendors. The driver is now heavily signatured, but the code is adaptable to other vulnerable drivers.

A researcher demonstrated that a Windows MiniFilter driver can be abused to prevent EDR drivers from loading by hijacking their unique Altitude value. This technique exploits the load order of MiniFilters and the requirement that each Altitude be unique, effectively blinding EDR telemetry by blocking kernel callbacks. The issue affects multiple EDR vendors, though some mitigations have been implemented.

A proof-of-concept Xposed module demonstrates bypassing the Protectt.ai security solution in the Kotak Neo Android app. The module uses a single hook to evade Protectt.ai's detection mechanisms, which are criticized for high false positives and easy bypassability. The project aims to highlight weaknesses in Protectt.ai to encourage improved security.