graypwn/mhydeath

Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.

mhydeath

Abusing mhyprotect (not mhyprot2) to kill AVs / EDRs / XDRs / Protected Processes.

Resources

https://github.com/ZeroMemoryEx/Terminator
https://github.com/kkent030315/evil-mhyprot-cli

Demo

Crowdstrike Falcon and MsDefender