zer0condition / mhydeath Public

Notifications You must be signed in to change notification settings
Fork 72
Star 407

Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.

407 stars 72 forks Branches Tags Activity

Notifications

Name		Name	Last commit message	Last commit date
Latest commit History 11 Commits
mhydeath		mhydeath
.gitattributes		.gitattributes
.gitignore		.gitignore
README.md		README.md
demo.gif		demo.gif
mhydeath.sln		mhydeath.sln

Repository files navigation

mhydeath

Abusing mhyprotect (not mhyprot2) to kill AVs / EDRs / XDRs / Protected Processes.

Resources

https://github.com/ZeroMemoryEx/Terminator
https://github.com/kkent030315/evil-mhyprot-cli

Demo

Crowdstrike Falcon and MsDefender