KRUEGER

Summary from the TLDR InfoSec newsletter

Krueger, a .NET post-exploitation tool, can remotely disable Endpoint Detection and Response (EDR) during lateral movement procedures. It utilizes Windows Defender Application Control (WDAC), a Microsoft application control utility capable of blocking code at both user and kernel-mode levels. With administrative privileges on a remote target, Krueger can deploy a WDAC policy and remotely reboot the device, preventing the EDR service from starting.