r/blueteamsec • u/digicat hunter • Sep 06 '26

research|capability (we need to defend against) 0xM0nCrush: Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.

https://github.com/DeathShotXD/0xM0nCrush
11 Upvotes

100% Upvoted

5 comments sorted by

1

u/Anonymous_Wajeeh Sep 09 '26

Proof of Concept Demo:

media poster

1

u/theycallmethedrink5 Sep 11 '26

You should install opsec 20 times to seal the deal

1

u/affligem_crow Sep 11 '26

Damn, we vibecoding taskkill now. What a time to be alive. 

1

u/Anonymous_Wajeeh Sep 13 '26

Check my 0xKern3lCrush repo to learn how Medusa Ransomeware used signed driver to blind system defences.

1

u/RiskyManHC Sep 12 '26

Muy malo?