Backstab: kill antimalware protected processes
Backstab
Kill EDR Protected Processes
Have these local admin credentials but the EDR is standing in the way? Unhooking or direct syscalls are not working against the EDR? Well, why not just kill it? Backstab is a tool capable of killing antimalware-protected processes by leveraging the Sysinternals’ Process Explorer (ProcExp) driver, which is signed by Microsoft.
How is that possible?
ProcExp has a signed kernel driver that it loads on startup, which allows it to kill handles that cannot be killed even as an administrator. When you use the UI, you cannot kill a protected process, but you can kill it handles because ProcExp UI instructs the kernel driver to kill those handles. Backstab does the same thing but without the UI element.
OpSec
Here is a quick rundown of what happens
- An embedded driver is dropped to disk
- Registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services is created
- The privilege SE_PRIVILEGE_ENABLED is acquired because it is necessary to load the driver
- A driver is loaded using NtLoadDriver to avoid creating a service
- The created Registry key is deleted (service not visible during execution)
- Communication with the driver is via using DeviceIoControl
- For handle enumeration, NtQuerySystemInformation is called
What you should also know
- The behavior of the tool mimics that of ProcExp. ProcExp drops the driver to the disk, create a registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services, calls NtLoadDriver, and then delete the registry key
- You can specify the location to which the driver is dropped and the service name
- When done, the app will unload the driver if you specify the option to unload the driver. The driver is unloaded by first re-creating the registry keys and then calling NtUnloadDriver
- The loaded driver is signed by MS
- The process does not attempt to directly kill protected processes handles, it instructs the ProcExp driver to kill them. You won’t be accused of attempting to tamper with any processes
