■■■■■ This repo is the result of hunting and reversing vulnerable signed kernel drivers for over a year. Every killer here abuses a legitimate driver to terminate any process from kernel mode, PPL-protected or not. Works on EDR/AV protected processes.
Each POC does a simple process kill by PID, you just customize it to whatever EDR process you want dead and it handles the rest from kernel. New ones get dropped as they get reversed.
https://github.com/redteamfortress/KillerLand