Kill-Floor

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #typescript #llm #go #golang #android #machine-learning #rust #deep-learning #linux

(★ 45)

AV/EDR killer using BYOVD technique

Kill-Floor Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Kill-Floor

Kill-Floor is an AV/EDR killer utilizing Avast’s “Anti Rootkit” driver. The code structure is designed to be adaptable for other BYOVD (Bring Your Own Vulnerable Driver) attack types. However, after a year, the included driver (`aswarpot.bin`) is heavily signatured by most vendors. For effective use, consider replacing the driver with a less detectable alternative for your operations.

## Execution Flow

The Kill-Floor tool operates as follows:

1. Write the driver to disk (stored as an array within the file for convenience).
2. Create a service and load the driver.
3. Enter an infinite loop, taking snapshots of running processes.
4. Identify and terminate processes associated with known AV/EDR vendors.
5. Repeat.

## Usage  
Compile and run as administrator.

## References

[Finding and Exploiting Process Killer Drivers with LOL for $3,000 (Alice Climent-Pommeret)](https://alice.climent-pommeret.red/posts/process-killer-driver/)  
[Vulnerable Antivirus Driver Used by Ransomware (OALabs)](https://www.youtube.com/watch?v=ViWLMfSwGVA)

Kill-Floor

Kill-Floor Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Kill-Floor

Kill-Floor Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README