DARK-KILL

Summary from the TLDR InfoSec newsletter

A user-mode code and its rootkit that will kill EDR processes permanently by leveraging the power of Process Creation Blocking Kernel Callback Routine registering and ZwTerminateProcess.