Backstab - a tool to kill antimalware protected processes

January 10, 2022

Kill EDR Protected Processes

Have these local admin credentials but the EDR is standing in the way? Unhooking or direct syscalls are not working against the EDR? Well, why not just kill it? Backstab is a tool capable of killing antimalware protected processes by leveraging sysinternals’ Process Explorer (ProcExp) driver, which is signed by Microsoft.

What can it do?

Usage: backstab.exe <-n name || -p PID> [options]  
	-n,	Choose process by name, including the .exe suffix
	-p, 	Choose process by PID
	-l, 	List handles of protected process
	-k, 	Kill the protected process by closing its handles
	-x, 	Close a specific handle
	-d, 	Specify path to where ProcExp will be extracted
	-s, 	Specify service name registry key
	-u, 	Unload ProcExp driver
	-a,	adds SeDebugPrivilege
	-h, 	Print this menu

	backstab.exe -n cyserver.exe -k 			[kill cyserver]
	backstab.exe -n cyserver.exe -x E4C 		[Close handle E4C of cyserver]
	backstab.exe -n cyserver.exe -l 			[list all handles of cyserver]
	backstab.exe -p 4326 -k -d c:\\driver.sys 	[kill protected process with PID 4326, extract ProcExp driver to C:\ drive]

How is that possible?

ProcExp has a signed kernel driver that it loads on startup, which allows it to kill handles that cannot be killed even as an administrator. When you use the UI, you cannot kill a protected process, but you can kill it handles because ProcExp UI instructs the kernel driver to kill those....

Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Inline Feedbacks
View all comments
© HAKIN9 MEDIA SP. Z O.O. SP. K. 2023
What certifications or qualifications do you hold?
Max. file size: 150 MB.

What level of experience should the ideal candidate have?
What certifications or qualifications are preferred?

Download Free eBook

Step 1 of 4


We’re committed to your privacy. Hakin9 uses the information you provide to us to contact you about our relevant content, products, and services. You may unsubscribe from these communications at any time. For more information, check out our Privacy Policy.