Red Team Road Rage - Weaponizing Vulnerable Drivers to Blind EDR

Explore advanced red team techniques in this 30-minute conference talk that demonstrates how attackers can exploit vulnerable third-party drivers to circumvent sophisticated Endpoint Detection & Response (EDR) systems. Learn about EDR architecture with particular emphasis on kernel-mode components, understand the various telemetry sources these security tools rely on, and discover how malicious actors leverage driver vulnerabilities to effectively blind EDR agents. Gain comprehensive insights into the inner workings, capabilities, and inherent limitations of market-leading EDR solutions while understanding the evolving cat-and-mouse game between attackers and defensive technologies. Presented by Jake Mayhew, an experienced offensive security professional and technical lead at UPMC, who brings real-world expertise from consulting across finance, healthcare, retail, critical infrastructure, and legal sectors, along with advanced certifications including OSCE3, OSCP, CRTO, and OSDA.