Kill EDR from kernel space with a vulnerable driver
A signed but exploitable driver gives you kernel primitives to terminate or blind protected security processes user mode cannot touch.
Tag: edr-evasion
Restore clean syscalls by unhooking ntdll
EDRs patch userland ntdll functions; mapping a fresh copy from disk removes their hooks before you make sensitive calls.