Henrik Falk March 26, 2026
EDR killers explained: Beyond the drivers
In this blogpost, we present our view of EDR killers, grounded in ESET telemetry and incident investigations. The research is based on the analysis and tracking of almost 90 EDR killers actively used in the wild. Our focus goes beyond the vulnerable drivers that dominate most discussions: we document how affiliates select, adapt, and operate EDR killers across real intrusions, and what that means for attribution and defense.
www.welivesecurity.com/en/eset-research/edr-killers-explained-beyond-the-drivers
Your Red Team Lab Is Too Fat. Here’s How I Fixed Mine.
I built a full red team lab — attacker machine, C2 framework, Windows victim — running comfortably under 6 GB RAM total. No lag, no thermal throttling, no selling a kidney for hardware. Here’s the reality check nobody talks about: Kali Linux sitting idle eats 1000–1200MB of RAM before you’ve even opened a terminal. MX Linux? 200–300MB idle. That’s not a small difference — that’s the difference between your lab running smooth and your laptop sounding like it’s filing a noise complaint.
medium.com/@aviraj3868/your-red-team-lab-is-too-fat-heres-how-i-fixed-mine-32053403a276
Every Sliver C2 Tutorial Was Outdated. So I Wrote My Own
The main thing is every C2 has its own signature, and the open source ones are already known by blue teams, they know every inch of it. So setting it up and then making it invisible is a real challenge. In this blog I’ll make sure you understand how to setup Sliver and get things working.
medium.com/@aviraj3868/every-sliver-c2-tutorial-was-outdated-so-i-wrote-my-own-cd47c50add3f
