Excited to share my latest research about FIN7 🔥 The discovery of a new abuse for the Windows built-in driver ProcLaunchMon.sys (TTD Monitor driver) to tamper with EDRs has been an interesting surprise. Enjoy the read 👇 sentinelone.com/labs/fin7-rebo…

@splinter_code Great work Antonio!

@splinter_code nice work coco!

@splinter_code Great stuff!

@splinter_code GRande Antonio

@splinter_code 👏 Great work and writeup! Also, thanks for sharing the PowerTrash unpacker 🙂

@splinter_code @hasherezade Pretty impressive work 👍👏 I really like all the content but also the PowerShell AST unpacker - I am familiar with that but still learned a lot of new things 🤗🙏💙 Great job Antonio 🔥💪

@splinter_code Great job and amazing research! Can't even imagine how much work and skills were needed for this analysis 💪And Wow! I wasn't aware of your PowerShell skills 😄