vs EDR

WPF abuse to silence an agent

• EDRPrison: https://github.com/senzee1984/EDRPrison, https://www.3nailsinfosec.com/post/edrprison-borrow-a-legitimate-driver-to-mute-edr-agent
• EDRSilencer: https://github.com/netero1010/EDRSilencer,detection: https://mahmoudelfawair.me/posts/theazurelabdiariesdetectingedrsilencers/
• https://github.com/loosehose/SilentButDeadly

bindlink API abuse

• https://github.com/zero2504/EDR-GhostLocker

• https://ipurple.team/2026/02/02/applocker-rules-abuse/

• EDR-Redir: https://www.zerosalarium.com/2025/11/EDR-Redir-V2-Blind-EDR-With-Fake-Program-Files.html?m=1, https://ipurple.team/2025/12/01/bind-link-edr-tampering/

• EDRStartupHinder: https://www.zerosalarium.com/2026/01/edrstartuphinder-edr-startup-process-blocker.html?m=1