Sec Note
1.56K subscribers
86 photos
5 videos
32 files
159 links
Download Telegram
When the hunter becomes the hunted: Using custom callbacks to disable EDRs
Security software and EDR systems register their process creation callbacks in this array using functions such as PsSetCreateProcessNotifyRoutine, PsSetCreateProcessNotifyRoutineEx, and PsSetCreateProcessNotifyRoutineEx2. Each of these functions allows drivers to add their specific callbacks to the array, enabling them to monitor process creation events effectively.

How can we use that functions?

#edr #malware_dev
👾2