Tool for Disabling EDR Solutions for Sale

For informational purposes only.

Price: $4,500

The tool is reportedly based on the BYOVD (Bring Your Own Vulnerable Driver) technique. The principle is that the program loads a legitimate but vulnerable driver into Windows. Through this vulnerability, it gains the ability to perform privileged operations in the system kernel and, in particular, to interfere with the operation of security programs. The author claims that, as of 2026, he considers this approach one of the most reliable ways to disable modern EDR solutions.

The product sold is not just a ready-made .exe file, but a package that includes the source code written in C++. According to the seller, the buyer can recompile and modify the program on their own. The product is said to support more than 30 EDR products and includes an updated list of their processes. The program offers several modes. It can search for running security products, terminate selected processes, continuously monitor for their reappearance and stop them again, as well as attempt to disable the corresponding services. Separately, the author states that it is possible to terminate Windows-protected processes of the PPL (Protected Process Light) type.

Administrator privileges are required for the driver to function. The author explicitly states that if the buyer additionally needs a workaround for UAC to obtain such privileges, this is a separate service. Another part of the offer involves drivers. The package includes signed drivers, and for an additional fee, the seller offers the source code for his own vulnerable driver.

The seller also promises some post-sale support. If security products begin to detect his program, he promises to rework the obfuscation once. As a demonstration, he claims he can show the buyer a video in which Bitdefender EDR is disabled, after which Mimikatz runs on the machine.

In one scan, the EDRKiller.sys file is reportedly not detected by any of the tested engines, while in a more recent scan, there is only 1 out of 36.