Windows Gather EDR & Defender Audit

Audit Windows Defender status, RunAsPPL, Credential Guard / VBS, AMSI availability, and common EDR process indicators. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name":...

EUVD-2023-49299

Malicious code in bioql PyPI...

CVE-2023-44976

Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023...

CVE-2023-44976

Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023...

CVE-2023-44976

Hangzhou Shunwang Rentdrv2 (versions prior to 2024-12-24 ) contains a vulnerability in the DeviceIoControl function. This flaw allows local users to terminate Endpoint Detection and Response (EDR) processes by using control code 0x22E010 . The vulnerability was exploited in the wild in October 20...

CVE-2023-44976

Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023...

CVE-2023-44976

Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023...

PT-2025-31640

Name of the Vulnerable Software and Affected Versions Hangzhou Shunwang Rentdrv2 versions prior to 2024-12-24 Description Hangzhou Shunwang Rentdrv2 is susceptible to a local privilege escalation issue. An attacker can terminate Endpoint Detection and Response EDR processes using a DeviceIoContro...