Two Seven One Three

New #redteam tool for blocking EDRs: EDRChoker Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events #pentest #cybersecurity Github: TwoSevenOneT/EDRChoker

@CDC_FI Yes 👍

@TwoSevenOneT Double checked Trellix Agent, too. Works, no updates, no Alert Transmission. Client looks dead in Server Console

New #redteam tool for blocking EDRs: EDRChoker Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events #pentest #cybersecurity Github: TwoSevenOneT/EDRChoker

@EAehorn I think you should determine which process handles the connection task to the MDE server first. I've already included it in the list, but I'm not sure it contains all the MDE processes

@TwoSevenOneT Does it have to do something with Tamper Protection being turned on? Does the setting bypass the QoS policies set?

@Tholgrim @0xedgerunnr TY 👍

@TwoSevenOneT @0xedgerunnr It works against cortex, if you're wondering

@Tank23x0 @cyb3rops No, I don't have a CS lab.

@TwoSevenOneT @cyb3rops Have you tested against Crowdstrike when alerting on low functionality mode?

@CDC_FI Yep 💪

@TwoSevenOneT OK, double checked with another client. It worked against tanium. Maybe more than 20 QoS Policys at the same time are too much. If i only use the few Tanium processes your PoC works against it

@osintashleyr @0x534c The Obfuscation Game ;)

@0x534c @TwoSevenOneT Yeah never really a hacking tool public or you get burned 🥵

EDRChoker has been apprehended 😅 @TwoSevenOneT - Game over for MDE #Cybersecurity #Threatdetection #RedTeam #EDRChoker

@CDC_FI 🤔

@TwoSevenOneT Sure, but what do you want to hear. Tanium only consists of two binaries. I added them, rebootet and Client was still able to speak with the Server, Accept incomming request and send Alerts ¯\_(ツ)_/¯

@0x534c So fast ⚡

@XanacR74233 Review what, my friend?

@TwoSevenOneT I sincerely apologize for any inconvenience caused. I believe this was a misunderstanding and kindly request a review.

@M43LS70M3 So, the problem may be that msmpeng.exe is not downloading files itself.

@TwoSevenOneT looking at process explorer under MsMpEng trying to download security intelligence will open MsCmdRun and a svchost process followed by increased network bandwidth usage inside process explorer. its always 10s of KB to a few MB

@_i04n 👍 nice

@TwoSevenOneT EDRUnChoker - registers a permanent WMI subscription with a 5-second timer that runs an embedded VBScript (fileless) deleting any MSFT_NetQosPolicySettingData policies targeting known security products or aggressive app-path throttles. github.com/sbousseaden/ED…

@0x534c Nice 👍 Can you still remotely control the client after it becomes inactive?

@TwoSevenOneT Good job Pal 👍 It did silent my MDE for a while until my detection kicks in😅 phew!

@IstaPee @RossMichaels328 @Defte_ So, EDR with core rules will trigger some warnings. But the most important thing is that the client now can’t send logs to the server anymore, right?

@TwoSevenOneT @RossMichaels328 @Defte_ there are some cloud-derived detections and blocks that CS does somewhat retroactively, and those would not happen once the EDR is blinded. but the core ruleset lives on the endpoint and will block/detect things even without network connectivity.

@CDC_FI Could I have more details about Tanium?

@TwoSevenOneT Does not work for Trellix Endpoint Security (AV, not EDR) 10.7.20.14066 Does not work for Tanium Threat Response Agent (EDR) 7.6 Does (!) work for Trendmicro Deep Security Agent (AV, latest Version)

@MaleStunts Nope, I don't have an MDE lab

@TwoSevenOneT Got sauce for numbing defender ?

@mike_nolan__ Can you share more details about your lab setup?

@TwoSevenOneT Doesn't work on Defender XDR choking the following; mssense.exe msmpeng.exe nissrv.exe senseir.exe sensendr.exe sensetvm.exe mpdefendercoreservice.exe

@cr3ghost 🤣

@MaleStunts It's throttling, not blocking

@TwoSevenOneT It doesn’t stop windows defender l

@0xRhman You're welcome

@TwoSevenOneT Great work as always! Thank you for the article!

@KozlowskiTomasz Thanks 👍

@TwoSevenOneT Nasty staff. Good work