nvisosecurity/interceptorInterceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space
作者：@Cerbersec
Interceptor 是一个内核驱动程序，专注于通过修补内核回调和挂钩 IRP，在内核空间中篡改 EDR/AV 解决方案。 Interceptor 是 NVISO Security 红队实习期间的作品。相关博客文章可以在此处（kernel karnage）找到。
2022 年，Kernel Karnage 在 SANS Pen Test HackFest 上进行了展示，促使本仓库向公众发布，并附带以下演示：
要求：
构建步骤：
git clone https://github.com/NVISO-ARES/Interceptor.git该驱动程序可以安装在已禁用驱动程序签名强制（DSE）或处于测试签名模式的机器上。有关禁用 DSE 的解决方案，请参见此处。其他可选方案包括使用有效的代码签名证书对驱动程序进行签名。
注意：启用了 Secure Boot 或 Hypervisor-Protected Code Integrity (HVCI) 的机器不受影响。
可以从命令提示符或 PowerShell 创建和启动驱动程序（注意空格）：
sc create Interceptor type= kernel binPath= C:\Path\To\Driver\Interceptor.sys
sc start Interceptor
sc stop Interceptor
sc delete Interceptor
Usage: InterceptorCLI.exe <option> <parameter> <values>
Options:
-list <parameter>
vendors List all supported EDR vendors and their modules
modules List all loaded drivers
hooked List all hooked drivers
callbacks List all registered callbacks
-hook <parameter>
index <values> Hook driver(s) by index
name <device name> Hook driver by name (\Device\Name)
-unhook <parameter>
index <values> Unhook driver(s) by index
all Unhook all drivers
-patch <parameter>
vendor <name> Patch all modules associated with vendor
module <names> Patch all callbacks associated with module(s)
process <values> Patch process callback(s) by index
thread <values> Patch thread callback(s) by index
image <values> Patch image callback(s) by index
registry <values> Patch registry callback(s) by index
objectprocess <values> Patch object process callback(s) by index
objectthread <values> Patch object thread callback(s) by index
-restore <parameter>
vendor <name> Restore all modules associated with vendor
module <names> Restore all callbacks associated with module(s)
process <values> Restore process callback(s) by index
thread <values> Restore thread callback(s) by index
image <values> Restore image callback(s) by index
registry <values> Restore registry callback(s) by index
objectprocess <values> Restore object process callback(s) by index
objectthread <values> Restore object thread callback(s) by index
all Restore all callbacks
Values: space separated. see -list <modules | hooked | callbacks>
Name: case sensitive. see -list <vendors>