A tool to kill antimalware protected processes
Have these local admin credentials but the EDR is standing in the way? Unhooking or direct syscalls are not working against the EDR? Well, why not just kill it? Backstab is a tool capable of killing antimalware protected processes by leveraging sysinternals’ Process Explorer (ProcExp) driver, which is signed by Microsoft.
Usage: backstab.exe <-n name || -p PID> [options]
-n, Choose process by name, including the .exe suffix
-p, Choose process by PID
-l, List handles of protected process
-k, Kill the protected process by closing its handles
-x, Close a specific handle
-d, Specify path to where ProcExp will be extracted
-s, Specify service name registry key
-u, Unload ProcExp driver
-a, adds SeDebugPrivilege
-h, Print this menu
Examples:
backstab.exe -n cyserver.exe -k [kill cyserver]
backstab.exe -n cyserver.exe -x E4C [Close handle E4C of cyserver]
backstab.exe -n cyserver.exe -l [list all handles of cyserver]
backstab.exe -p 4326 -k -d c:\\driver.sys [kill protected process with PID 4326, extract ProcExp driver to C:\ drive]
ProcExp has a signed kernel driver that it loads on startup, which allows it to kill handles that cannot be killed even as an administrator. When you use the UI, you cannot kill a protected process, but you can kill it handles because ProcExp UI instructs the kernel driver to kill those handles. Backstab does the same thing but without the UI element.
Here is a quick rundown of what happens
While the tool purpose is listing and killing handles, the opportunities are vast. It is possible to duplicate the handles to your own process instead of killing them. This could allow for deeper tampering where you write to files, fire events, hold mutexes. To support further research, I tried to make the code readable and split it to many methods to facilitate reuse, I also left a description on all ProcExp related methods. Feel free to reach out to me on Twitter or by Email