AV/EDR KILLER FEATURE
=====================

OVERVIEW:
---------
The AV/EDR Killer feature allows you to disable antivirus and endpoint detection software
on target systems using a vulnerable kernel driver exploit.

HOW IT WORKS:
-------------
1. A vulnerable signed kernel driver (vulndriver.sys) is deployed to the target
2. The driver is registered as a Windows kernel service
3. Killer.exe uses the driver to terminate AV/EDR processes from kernel mode
4. Optional: Make the driver persistent across reboots

USAGE:
------
1. Right-click on a connected client in Quasar
2. Navigate to: Monitoring > AV/EDR Killer
3. The AV/EDR Killer window will open with 4 options:

   a) CHECK DRIVER - Verifies if the vulnerable driver is installed and running
   
   b) INSTALL DRIVER - Deploys and registers the vulnerable driver
      - Saves vulndriver.sys to a random temp directory
      - Registers it as "QuasarDriver" kernel service
      - Starts the driver service
      - Requires administrator privileges on target
   
   c) KILL AV/EDR - Executes the AV/EDR termination process
      - Deploys Killer.exe to random temp directory
      - Uses the vulnerable driver to kill security processes
      - Shows real-time output in the log window
      - Automatically cleans up after execution
   
   d) MAKE PERSISTENT - Configures driver to auto-start on boot
      - Modifies registry to enable automatic startup
      - Driver will load on every system boot

COMMAND OUTPUT WINDOW:
----------------------
The black console-style window at the bottom shows real-time output from the target:
- Green text = Normal output
- Red text = Errors
- All operations are logged with timestamps

IMPORTANT NOTES:
----------------
- This feature requires ADMINISTRATOR privileges on the target system
- The driver installation may trigger UAC prompts on the target
- AV/EDR termination is a HIGH-RISK operation that will trigger alerts
- Use responsibly and only on systems you have authorization to access
- The driver and killer are automatically deployed from the Resources folder

FILES INVOLVED:
---------------
- vulndriver.sys: Vulnerable kernel driver (38 KB)
- Killer.exe: AV/EDR termination tool (205 KB)
- Both files are embedded in Quasar.exe and deployed on-demand

TECHNICAL DETAILS:
------------------
- Driver service name: QuasarDriver
- Deployment location: Random subdirectory in %TEMP%
- Driver type: Kernel mode driver
- Communication: Real-time output streaming via protobuf messages
- Cleanup: Automatic removal of Killer.exe after execution

SECURITY CONSIDERATIONS:
------------------------
- This is an offensive security tool - use ethically
- May be detected by advanced EDR solutions
- Driver signing may be flagged by some security software
- Always test in controlled environments first
