redteamfortress/defenderkiller

DefenderKiller is a security research tool written in C++ that can force-shutdown any process on a Windows computer, including ones that are normally protected from being closed. It does this by repurposing a legitimate, Microsoft-signed driver file called KSLDriver.sys, which was originally built in 2011 for Microsoft's own malware protection software. Because the driver carries Microsoft's official digital signature, Windows trusts it at the highest level and allows it to run with deep system privileges. The core idea is notable because other similar tools typically rely on drivers from third-party companies. Since this driver is signed by Microsoft itself, it is not on Microsoft's Vulnerable Driver Blocklist, a security feature meant to stop known problematic drivers. The README claims the tool currently has zero detections across seventy antivirus engines on VirusTotal. It also states that the technique bypasses Protected Process Light (PPL), a Windows mechanism designed to shield critical system and security processes, and evades certain monitoring hooks that endpoint detection and response (EDR) software relies on. The tool works through a command-line interface with three main commands: load, kill, and unload. A user first loads the Microsoft-signed driver into the system, then specifies a target process by its name or numeric identifier to terminate it, and finally unloads the driver when done. When the kill command is issued, the tool communicates with the loaded driver through a specific internal control code, instructing the Windows kernel to terminate the target process directly. Since the termination happens at the kernel level, normal security software cannot easily intercept or block it. The author notes this is a proof of concept. Some security products have watchdog services that automatically restart their processes if they are killed. The author suggests the tool could be modified to run in a loop, repeatedly targeting known security process names to prevent them from restarting. The README includes a link to a detailed blog post on Medium covering the reverse engineering and technical breakdown of the driver. The project is framed for authorized security testing and educational purposes only, with a disclaimer that users should only run it on systems they own or have explicit permission to test.