EDRStartupHinder: Blocks Antivirus & EDR at Windows 11 25H2 Startup (Defender Included)

A cybersecurity researcher has unveiled EDRStartupHinder, a proof-of-concept tool that prevents antivirus and endpoint detection and response (EDR) solutions from launching during Windows startup, including Microsoft Defender on Windows 11 25H2.

The technique exploits Windows Bindlink API functionality through the bindflt.sys driver to interfere with security software initialization.

The tool builds on previous research into Bindlink API exploitation, which demonstrated methods to redirect AV and EDR folders at system startup.

However, EDRStartupHinder targets a critical earlier phase by preventing security services from launching at all during Windows initialization.

Technical Mechanism

The attack leverages the fact that all Windows processes, including EDR solutions, depend on DLLs located in the System32 folder.

EDRStartupHinder employs a four-step process: creating a service that runs before the EDR service, using Bindlink to redirect a core DLL to a corrupted version, exploiting the EDR’s Protected Process Light (PPL) protection to force self-termination, and removing the redirect after the EDR terminates.

The technique works by copying an original DLL from System32 and invalidating its digital signature.

When the PPL-protected EDR process attempts to load this unsigned DLL, it rejects the file and terminates itself automatically.

The researcher successfully tested this against Windows Defender using the msvcp_win.dll file and confirmed effectiveness against multiple commercial EDR products, though specific vendor names were withheld.

According to Zero Salarium, the tool is available on GitHub as EDRStartupHinder and requires administrator privileges to execute.

This research highlights persistent challenges in securing Windows endpoints against sophisticated adversaries who understand low-level system internals and service initialization sequences.

Organizations should monitor for suspicious service creation and DLL redirection activities as potential indicators of this technique.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.