Yaxser/Backstab

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1527 stars · 251 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Backstab is a Windows command-line tool that kills antimalware/EDR-protected processes by abusing the Microsoft-signed Sysinternals Process Explorer kernel driver. It loads the driver via NtLoadDriver and uses it to close protected process handles.

Use cases

• kill EDR protected processes from an admin shell
• close handles of a protected process by PID or name
• list open handles of antimalware processes
• red team evasion of endpoint protection
• unload the ProcExp driver after use

When to choose

• you have local admin on a Windows host and need to terminate an EDR-protected process
• you want a ProcExp-driver-based handle-killing tool with OpSec-conscious behavior
• you need to enumerate or close specific handles of protected processes

When to avoid

• you need a supported, licensed tool - the repo has no license
• you are on non-Windows platforms
• you want stealth from EDRs that detect ProcExp driver loading
• you need a maintained tool - last release was 2021

Facets

cli-tool · maturity maintenance

security penetration-testing cli security penetration-testing windows windows cli edr-evasion process-killing kernel-driver red-team handle-manipulation procexp-driver

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Yaxser/Backstab")