DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security

The abuse of legitimate, vulnerable drivers remains a persistent method of evading endpoint security controls. As EDR killer techniques become publicly available, researchers and threat actors alike are examining how weaknesses in driver access controls can be exploited to terminate protected security processes.

An older Microsoft Defender driver, dating back to 2011, can still be loaded on the latest version of Windows 11 and abused to terminate security software. The technique, publicly demonstrated through an open-source proof of concept (POC) called DefenderKiller, exploits weaknesses in how the driver restricts access to its process termination functionality.

Flashpoint analysts have identified 13 publicly available samples incorporating the DefenderKiller technique, including obfuscated variants that indicate modifications to the original POC.

DefenderKiller Exploits a Legacy Microsoft Driver

On June 29, 2026, security researcher Jehad Abudagga, also known as redteamfortress, published research demonstrating how an older Microsoft driver could be abused to terminate security software. The researcher subsequently released the DefenderKiller POC on GitHub. The technique targets KSLDriver.sys, version 1.1.0013.0, a driver associated with Microsoft’s malware protection infrastructure. Although its digital signature dates to 2011, the driver remains accepted by Windows’ driver verification mechanisms and can load into the kernel on the latest version of Windows 11.

KSLDriver includes access controls intended to restrict which processes can communicate with it. When loaded, the driver retrieves an AllowedProcessName value from its service registry configuration and applies restrictions limiting access to SYSTEM and administrator accounts. When a user-mode process attempts to communicate with the driver, its process image path is compared against the configured registry value. If the values match, the driver accepts input/output control (IOCTL) requests.

DefenderKiller exploits this mechanism by configuring the driver’s service and authorized process path before starting the driver. Once authorized, the requesting process can invoke functionality that accepts a target process identifier (PID), obtains the corresponding kernel process object, and terminates the process using ZwTerminateProcess(). This allows a sufficiently privileged attacker to leverage the legitimate driver to terminate security processes.

Following publication of the original POC, Flashpoint analysts identified 13 publicly available samples incorporating the DefenderKiller technique, including obfuscated versions. These findings indicate that the original code has been modified, although the available evidence does not establish whether the samples have been deployed in confirmed intrusions.

Implications for Endpoint Security

The findings illustrate how Bring Your Own Vulnerable Driver (BYOVD) techniques can exploit legitimate, digitally signed drivers to interfere with endpoint security. KSLDriver relies on process authorization checks that can be bypassed through manipulation of registry-controlled information, while remaining loadable on the latest version of Windows 11.

Flashpoint analysts assess that advances in large language models may be contributing to growing interest in BYOVD research and EDR killer development by making user-mode and kernel-mode code development more accessible. Exploitation generally requires administrative privileges to create the services necessary to load these drivers, although attackers may obtain these privileges through local privilege escalation.

Security teams should consider monitoring for unexpected kernel driver installations, changes to driver service configurations, and termination of security processes following driver loading. In particular, modifications to registry values such as AllowedProcessName and ImagePath may provide useful investigative context when correlated with suspicious service creation or driver activity.

Indicators of Compromise and Technical Artifacts

The following artifacts were identified during Flashpoint’s analysis and may support threat hunting and further investigation.

Artifact	Value
DefenderKiller service	DefenderKiller
DefenderKiller service registry key	HKLM\SYSTEM\CurrentControlSet\Services\DefenderKiller
Microsoft driver	KSLDriver.sys (1.1.0013.0)
Microsoft driver SHA-256	d5764d24e78914ab2a9db6b24e323342d0b37998f43add1a9e49b00992b0d645

The presence of these artifacts should be evaluated in context, as legitimate software may use some of these components.

Stay Ahead of EDR Evasion Techniques With Flashpoint

The discovery of vulnerable drivers beyond those targeted by publicly available EDR killers highlights the need for continued research into the techniques used to disable endpoint defenses. The public release of DefenderKiller, along with the emergence of modified variants, highlights the need for continued visibility into defense evasion techniques and the vulnerable drivers that enable them.

Flashpoint continuously monitors emerging threats and adversary techniques, combining primary source intelligence with technical research to help organizations understand how threats are evolving. Request a demo to learn how Flashpoint can help your team identify emerging threats and strengthen its defenses.